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EXECUTIVE SUMMARY 

In 2017, the Public Company Accounting Oversight Board ("PCAOB" or "the 
Board") conducted an inspection of the registered public accounting firm KPMG LLP 
("the Firm") pursuant to the Sarbanes-Oxley Act of 2002 ("the Act"). The inspection 
procedures included reviews of portions of the Firm's work on 52 issuer audits, which 
generally related to issuer year ends in 2016. 

The inspection team identified matters that it considered to be deficiencies in the 
performance of the work it reviewed. In 26 audits, certain of these deficiencies were of 
such significance that it appeared to the inspection team that the Firm, at the time it 
issued its audit report, had not obtained sufficient appropriate audit evidence to support 
its opinion. These deficiencies are described in Part I.A of the report. 

The Board cautions against using the number of audits with deficiencies in the 
public portion of a report to draw conclusions about the frequency of deficiencies 
throughout the firm's practice. The audits to be reviewed are most often selected based 
on perceived risk and not through a practice designed to identify a representative 
sample that could be extrapolated to the firm's entire practice. The portions of these 
audits that are reviewed often involve the most risky areas of the financial statements. 
Thus, much of the audit work that is inspected presents, in the inspection team's view, a 
heightened possibility of auditing deficiencies. 

In the 2017 inspection, the inspection team also assessed the Firm's system of 
quality control related to issuer audits. Pursuant to the Act, any criticisms or discussions 
of defects or potential defects in that system will remain nonpublic unless the Firm fails 
to address those criticisms or defects to the Board's satisfaction, within 12 months of the 
issuance of this report. 

Audit Opinions Affected by the Identified Deficiencies 

Fifty of the 52 engagements inspected were integrated audits of both internal 
control and the financial statements. As depicted in the table below, the inspection team 
identified deficiencies in both financial statement audits and audits of ICFR. 



Number of Audits 

Audits for which deficiencies included in Part I.A related to 
both the financial statement audit and the ICFR audit 

18 Audits: Issuers A, B, C, 

D, E, F, G, H, 1, J, K, L, M, 

O, R, T, U, and W 
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Number of Audits 

Audits for which deficiencies included in Part I.A related to the 

6 Audits: Issuers N, Q, S, V, 

ICFR audit only 

X, and Z 

Audits for which deficiencies included in Part I.A related to the 
financial statement audit only 

2 Audits: Issuers P and Y 

Total 

26 


Most Frequently Identified Audit Deficiencies 

The following table lists, in summary form, the types of deficiencies that appear 
most frequently in Part I .A of this report and shows which issuer audits included these 
deficiencies. 


Issue 


Part I.A Audits 

Failure to sufficiently test the design and/or operating 
effectiveness of controls that included a review element and that 
the Firm selected for testing 

17 Audits: Issuers A, B, 

C, D, G, H, 1, J, K, L, R, 

S, T, U, V, W, and Z 

Failure to identify and test any controls that addressed the risks 
related to a particular account or assertion 

13 Audits: Issuers A, B, 

F, G, H, K, M, N, O, Q, 

R, S, and T 

Failure to perform substantive procedures to obtain sufficient 
evidence as a result of relying too heavily on controls (due to 
deficiencies in testing controls) 

13 Audits: Issuers A, B, 

C, F, H, 1, J, L, M, O, T, 

U, and W 

Failure to sufficiently test significant assumptions or 
the issuer used in developing an estimate 

data that 

10 Audits: Issuers A, B, 
C, D, F, G, 1, K, P, and 

T 


Areas in which Audit Deficiencies Were Most Frequently Identified 

The following table lists, in summary form, the three financial statement accounts 
or auditing areas in which the deficiencies that are included in Part I.A of this report 
most frequently occurred. 
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Area 

Part I.A Audits 

Revenue, including allowances 

11 Audits: Issuers E, F, 

G, K, L, M, N.T, U,X, 
and Y 

Loans, including the allowance for loan losses 

6 Audits: Issuers A, B, 

C, H, 1, and O 

Inventory, including related reserves 

5 Audits: Issuers E, N, 

S, T, and W 
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PART I 

INSPECTION PROCEDURES AND CERTAIN OBSERVATIONS 

Inspections are designed and performed to assess compliance with applicable 
standards and requirements. The inspection team reviews both (1) selected audits and 
(2) policies and procedures related to quality control processes. The primary 
procedures 1 for the inspection were performed from November 2016 to April 2018. 
Inspectors conducted field work at the Firm's National Office and inspected issuer audits 
performed by 28 of the Firm's approximately 80 U.S. practice offices. 

Part I .A includes a description of all audit deficiencies that reach a defined level 
of significance, which is described below. These deficiencies are categorized in various 
ways in both Part I.B and the Executive Summary. Part I.C of this report provides 
certain demographic information about all of the audits inspected. Part I.D provides a 
general description of the procedures performed in an annual inspection. 

Inspections are designed to identify deficiencies in audit work and defects or 
potential defects in the firm's system of quality control. This focus on deficiencies and 
defects necessarily carries through to inspection reports and, therefore, the reports are 
not intended as balanced report cards or overall rating tools. Further, the lack of 
discussion within a report of an aspect of the inspected firm's quality control system 
should not be interpreted to imply that the Board has reached a conclusion about that 
aspect. Similarly, an inspection of an annually inspected firm does not involve the 
review of all of the firm's audits, nor is it designed to identify every deficiency in the 
reviewed audits. Accordingly, an inspection report should not be understood to provide 
any assurance that a firm's audit work, or the relevant issuers' financial statements or 
reporting on ICFR, are free of any deficiencies not described in that report. 

The inspection team's evaluation of the Firm's quality control system included 
both (1) a review of certain aspects of the Firm's quality control system and (2) an 


1 For this purpose, the time span for "primary procedures" includes field 
work, other review of audit work papers, and the evaluation of the Firm's quality control 
policies and procedures through review of documentation and interviews of Firm 
personnel. The time span does not include (1) inspection planning, which may 
commence months before the primary procedures, and (2) inspection follow-up 
procedures, wrap-up, analysis of results, and the preparation of the inspection report, 
which generally extend beyond the primary procedures. 
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assessment whether the deficiencies identified in individual audits indicate defects or 
potential defects in the Firm's quality control system. 

A. Review of Audit Engagements 

The inspection procedures included reviews of portions of 51 issuer audits 
performed by the Firm and a review of the Firm's audit work on one other issuer audit 
engagement in which the Firm played a role but was not the principal auditor. The 
inspection team selected these issuer audits for review after it learned that the Firm 
obtained improper advance notice of the initial engagements selected. 

Certain of the deficiencies identified in the inspection were of such significance 
that the inspection team determined that the Firm issued an opinion without obtaining 
sufficient appropriate audit evidence that the financial statements were free of material 
misstatement and/or the issuer maintained effective ICFR. These deficiencies are 
described in Part LA. The descriptions in Part I .A include references to the auditing 
standards that most directly relate to those deficiencies. (See Appendix C for the text of 
these standards.) References to provisions of the auditing standards that generally 
address all aspects of the audit are provided only when lack of compliance with these 
standards is the primary reason for the deficiency. 2 

Inclusion in an inspection report does not mean that the deficiency remained 
unaddressed after the inspection team brought it to the firm's attention. In many cases, 
the Firm has since performed remedial actions intended to address the deficiencies. 3 
That an audit deficiency reached the level of significance to be included in Part I.A of an 
inspection report does not mean that the financial statements are misstated or that there 
are undisclosed material weaknesses in ICFR. It is often not possible for the inspection 


These broadly applicable provisions are described in Part I.B of this 

report. 

Depending upon the circumstances, compliance with PCAOB standards 
may require the firm to perform additional audit procedures, or to inform a client of the 
need for changes to its financial statements or reporting on internal control, or to take 
steps to prevent reliance on its previously expressed audit opinions. An inspection 
normally includes a review, on a sample basis, of the adequacy of a firm's compliance 
with these requirements, either with respect to previously identified deficiencies or 
deficiencies identified during that inspection. Failure by a firm to take appropriate 
actions could be a basis for criticisms of the firm's quality control system or Board 
disciplinary sanctions. 
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team to reach a conclusion on those points because the inspection team usually has 
only the information the auditor retained and the issuer's public disclosures. Even when 
not associated with a disclosed misstatement or previously unidentified material 
weakness, an auditor's failure to obtain sufficient appropriate audit evidence is a serious 
matter. 


The audit deficiencies that were so significant that it appeared that the audit 
opinion was unsupported are described in Parts I.A.1 through I.A.26, below. Issuer 
audits are generally presented in the order of significance of the deficiencies identified 
in the inspections of those audits; severity is assessed based on extent of the 
deficiencies identified in the audit, financial statement accounts affected, and/or 
potential consequences of the audit deficiency. 4 

Audit Deficiencies 

A.1. Issuer A 

In this audit of an issuer in the financials industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinions on the financial statements and on the effectiveness of ICFR - 

• The issuer engaged in various activities that evidenced the presence of 
fraud risk factors that were indicative of risks of material misstatement due 
to fraud with respect to loans, the allowance for loan losses ("ALL"), 
available-for-sale ("AFS") securities, certain derivatives, and deposit 
liabilities (the "accounts"). The Firm failed to perform sufficient procedures 
related to these accounts, as follows - 

o The Firm failed to consider the implications of certain of these fraud 
risk factors in determining whether there were risks of material 
misstatement due to fraud in the accounts. (AS 2110.65) 

o To address certain other fraud risk factors it had identified, the Firm 
selected for testing four entity-level controls. Three of these 
controls consisted of reviews related to certain aspects of the 
issuer's control environment, and the fourth control consisted of the 


The 2015 and 2016 audits of Issuers A, B, C, H, I, J, O, and Q were 
inspected during both the 2016 and 2017 PCAOB inspections; these inspections 
occurred during calendar year 2017, after the conclusion of the audits of both years. 
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internal audit function's monitoring of other controls. The Firm's 
procedures to test these controls were insufficient, as the Firm 
failed to test, other than for one control for one line of business, 
whether the control owners' evaluations and/or conclusions 
regarding the operation of these controls were reasonable and 
appropriately supported. (AS 2201.42 and .44) 

o The Firm designed certain of its substantive procedures - including 
the sample sizes used in those procedures - based on levels of 
control reliance and assessments of the risks of material 
misstatement due to fraud that were not supported due to the 
deficiencies in the Firm's testing of controls and in its risk 
assessment procedures that are discussed above. As a result, 
certain of the sample sizes that the Firm used to test the existence 
of loans and deposit liabilities and the valuation of the ALL, AFS 
securities, and certain derivatives were too small to provide 
sufficient evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, 
and .23A) 

The Firm failed to perform sufficient procedures related to the issuer's 

ALL, mortgage servicing rights ("MSRs"), and derivatives. Specifically - 

o The issuer used various models in the valuation of (1) the ALL for 
loans collectively assessed for impairment, (2) MSRs, and (3) a 
significant portion of derivatives ("certain derivatives"). The Firm 
selected for testing one control over the validation of these models; 
this control included the review of significant assumptions used in 
the models. The Firm limited its procedures to test this control to (1) 
inquiring of the control owners; (2) evaluating the competence and 
objectivity of the control owners; and (3) reading the issuer's model 
risk management policy, issuer-prepared reports, and supporting 
analyses. For certain of the significant assumptions selected for 
testing included within certain models, the Firm failed to evaluate 
the nature of the procedures the control owners performed to 
review the assumptions, including the specific expectations the 
control owners applied and the criteria the control owners used to 
identify items for follow up. In addition, the Firm selected for testing 
a control over the review of the implementation of and changes to 
the program the issuer used to transfer information from the data 
warehouse into a model used to determine a portion of the ALL for 
loans collectively assessed for impairment. This model and the 
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related control were implemented during the year under audit. The 
Firm failed to sufficiently test the aspect of the control related to the 
review of the baseline code at the time of implementation, as its 
procedures were limited to inquiry of the control owner. (AS 
2201.42 and .44) 

o The Firm selected for testing two controls over a significant portion 
of the issuer's loan portfolio. The first control consisted of 
management's quarterly reviews of loan valuation calculations, the 
majority of which were prepared using a discounted cash flow 
approach, and the second control consisted of management's 
monthly reviews of loan charge-off determinations. The Firm limited 
its procedures to test these controls for those loans valued using a 
discounted cash flow approach to (1) inquiring of the control owners 
and (2) inspecting a sample of discounted cash flow worksheets or 
loan status reports and related documents for signatures as 
evidence of review. The Firm failed to evaluate the nature of the 
review procedures the control owners performed, including the 
criteria the control owners used to identify items for follow up and 
the resolution of such matters. (AS 2201.42 and .44) 

o The Firm designed certain of its substantive procedures for the 
valuation of the ALL and certain derivatives - including the sample 
sizes used in those procedures - based on a level of control 
reliance that was not supported due to the deficiency in the Firm's 
testing of the model validation control that is discussed above. As a 
result, certain of the sample sizes that the Firm used to test the 
valuation of the ALL and certain derivatives were too small to 
provide sufficient evidence. (AS 2301.16, .18, and .37; AS 2315.19, 
.23, and .23A) 

o The Firm's approach for testing the ALL was to review and test 
management's process. The Firm, however, failed to perform 
sufficient substantive procedures to evaluate the reasonableness of 
certain significant assumptions that the issuer used as inputs to the 
models to estimate the value of the ALL associated with loans 
collectively assessed for impairment. Specifically, the Firm's only 
procedures to test these assumptions were inquiring of 
management and reading issuer-prepared reports and supporting 
analyses, without performing any testing of these analyses. (AS 
2501.11) 
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• During the year, the issuer acquired a significant business. The Firm failed 
to perform sufficient procedures related to the accounting for this business 
combination, as follows - 

o The Firm selected for testing a control that consisted of the 
determination, and review of the appropriateness, of the accounting 
treatment for all significant transactions. This control, however, did 
not address the risk that the purchase price allocation could be 
inaccurate, and the Firm failed to identify and test any other 
controls that addressed this risk. (AS 2201.39) 

o The Firm failed to perform sufficient substantive procedures to test 
the accuracy of the loan account balances that were used to value 
the acquired loans. The Firm (1) inspected the purchase agreement 
and (2) selected a sample of loans from the loan service systems 
for a portion of the acquired loans and compared certain of the loan 
information to the acquired company's loan origination documents. 
The Firm, however, failed to test whether the account balances of 
these loans were accurate as of the acquisition date. In addition, 
the Firm excluded a significant portion of the loans from the 
population from which it selected its sample for testing. (AS 
2502.39) 

A.2. Issuer B 

In this audit of an issuer in the financials industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinions on the financial statements and on the effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures with respect to the ALL. 
Specifically - 

o The issuer used models in the determination of the ALL. The Firm 
selected for testing a control consisting of the validation of these 
models. The Firm limited its procedures to test this control to (1) 
inquiring of the control owners, (2) reading the issuer's model 
governance and validation standards, (3) reading the validation 
reports and supporting analyses, (4) evaluating the competence 
and objectivity of the control owners, and (5) reviewing changes to 
the models since their last validation dates. The Firm failed to 
evaluate the nature of the review procedures performed by the 
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control owners, including the specific expectations applied in the 
reviews, the criteria used to identify items for follow up, and the 
resolution of such matters. (AS 2201.42 and .44) 

o The Firm selected for testing a control consisting of a committee's 
review and approval of the look-back period, which was an 
important assumption used in the determination of the ALL. The 
Firm limited its procedures to test this control to (1) inquiring of 
certain control owners and (2) reading minutes from the committee 
meetings, noting that the committee had approved changes to the 
look-back period in the third and fourth quarters. The Firm failed to 
evaluate the nature of the specific review procedures that the 
committee performed to reach its conclusions about the 
reasonableness of the look-back period. (AS 2201.42 and .44) 

o The Firm's approach for testing the ALL was to review and test 
management's process. The Firm, however, failed to perform 
sufficient procedures to evaluate the reasonableness of the 
portfolio segmentation and look-back period assumptions, which 
were key inputs to the ALL determination. Specifically, the Firm's 
only procedures to test these assumptions were inquiring of 
management and reading model validation reports and their 
supporting analyses, without performing any testing of these 
analyses. (AS 2501.11) 

The Firm failed to perform sufficient procedures with respect to deposit 

liabilities. Specifically- 

o The issuer used a service organization to generate retail deposit 
customer statements using information from the issuer's retail 
deposit system. The Firm identified and tested a control that 
consisted of testing the mathematical accuracy of information 
appearing on a sample of retail deposit statements, including by 
comparing the information on the statements to the retail deposit 
system. The Firm, however, failed to identify and test any controls 
over the completeness of the information transferred from the 
issuer's retail deposit system to the service organization. (AS 
2201.39) 

o The Firm designed certain of its substantive procedures - including 
the sample sizes used in those procedures - based on a level of 
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control reliance that was not supported due to the deficiency in the 
Firm's testing of the control that is discussed above. As a result, the 
sample sizes that the Firm used in its testing of retail deposits were 
too small to provide sufficient evidence. (AS 2301.16, .18, and .37; 
AS 2315.19, .23, and .23A) 

o The Firm sent positive confirmation requests to the issuer's 
customers for certain retail demand deposit accounts. The Firm 
also selected for testing a sample of retail deposits for which it did 
not send positive confirmation requests. The Firm failed to 
sufficiently test those accounts for which the requested 
confirmations were not returned, as well as the sample of retail 
deposit accounts that was not included in the confirmation test, as it 
limited its procedures in both tests to (1) comparing customer 
names and account numbers from account signature cards to 
customer statements and (2) comparing account balances on the 
customer statements to the deposit system from which the 
statement information was obtained. (AS 2301.08; AS 2310.31) 

• The Firm failed to perform sufficient procedures to test loans receivable. 
Specifically, the Firm sent positive confirmation requests to the issuer's 
customers for a sample of loan receivable accounts. The Firm failed to 
sufficiently test those loans receivable in its sample for which the 
requested confirmations were not returned, as it limited its alternative 
procedures to (1) recalculating the customer's loan balance using billing 
statements that were produced by the loan receivable systems that had 
also been used to generate the confirmation requests and (2) comparing 
payment information on the billing statements to the loan receivable 
systems. (AS 2310.31) 

A.3. Issuer C 

In this audit of an issuer in the financials industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinions on the financial statements and on the effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures related to the ALL. 
Specifically - 

o The Firm selected for testing a control that consisted of a 
committee's review of the risk assessment for graded commercial 
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loans; this review included evaluating the risk of assigning an 
inappropriate loan grade for each loan portfolio and determining 
which loan portfolios would be subject to an independent loan- 
grade review. The loan grades were an important factor in 
estimating the general reserve component of the ALL for 
commercial loans. As part of the control, the committee identified 
three commercial loan portfolios as having high risk of inappropriate 
loan grades and determined that these loan portfolios would be 
subjected to the independent loan-grade review every six to 15 
months. The Firm failed to consider that this control was not 
designed, in the period under audit, to require that significant loan 
portfolios identified as high risk be subject to an independent loan- 
grade. (AS 2201.42) 

o The issuer subjected all three of the high-risk loan portfolios it 
identified to its independent loan-grade review control in the period 
under audit. The Firm, however, in testing the operating 
effectiveness of this control failed to include one of these portfolios 
in the population of high-risk loans from which it selected items for 
testing. This portfolio represented approximately 50 percent of the 
total high-risk loans. (AS 2201.44) 

o The Firm designed certain of its substantive procedures - including 
the sample size used in those procedures - based on a level of 
control reliance that was not supported due to the deficiencies in 
the Firm's testing of the controls that are discussed above. As a 
result, the sample size the Firm used to test the appropriateness of 
the assigned loan grades for commercial loans was too small to 
provide sufficient evidence. (AS 2301.16, .18, and .37; AS 2315.19, 
.23, and .23A) 

o The Firm selected for testing a control that consisted of 
management's review and approval of retail loan charge-offs, which 
were significant inputs to the calculation of the general reserve 
component of the ALL for retail loans. The Firm limited its 
procedures to test this control to inquiring of the control owner and 
reading the loan charge-off report used to record charge-offs in the 
loan system. The Firm failed to evaluate the nature of the review 
procedures the control owner performed, including the criteria the 
control owner used to determine the appropriateness of the charge- 
offs. In addition, the Firm failed to identify and test any controls over 
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the accuracy and completeness of the loan charge-off report that 
the control owner used in the performance of this control. (AS 
2201.39, .42, and .44) 

o The Firm failed to perform sufficient substantive procedures to test 
retail loan charge-offs, as its procedures were limited to comparing 
a sample of retail loan charge-offs from the loan system to the loan 
charge-off report, without inspecting any supporting documentation 
for these charge-offs. (AS 2501.11) 

• The Firm failed to perform sufficient procedures to test controls over AFS 
securities. The issuer recorded the fair values for these securities based 
on the prices it received from an external pricing service. The Firm 
selected for testing one control over the valuation of these securities that 
consisted of the issuer's semi-annual comparison of the recorded fair 
values for a sample of its largest securities to prices it received from 
another external pricing service and investigation of any pricing 
differences that exceeded a threshold. The issuer established a single 
threshold for investigation, regardless of the types of securities within the 
issuer's portfolio. The remaining securities for which the issuer did not 
perform this comparison were, in the aggregate, multiple times the Firm's 
established level of materiality and presented a reasonable possibility of 
material misstatement. The Firm failed to sufficiently test whether this 
control was designed appropriately to detect misstatements that could be 
material, as it did not evaluate (1) whether the issuer's sampling strategy 
was appropriate given that a significant portion of the recorded balance 
was not subject to the price comparison and (2) whether the single 
threshold that the control owner used, regardless of the type of security, 
was sufficiently precise. (AS 2201.42) 

A.4. Issuer D 

The Firm was engaged by the principal auditor of an issuer in the materials 
industry sector to audit the financial statements and perform certain procedures on 
ICFR of a significant subsidiary of the issuer to support the principal auditor's opinions 
on the consolidated financial statements and on the effectiveness of ICFR of the issuer. 
The Firm failed to obtain sufficient appropriate audit evidence to fulfill the objectives of 
its role in the audit, as its procedures related to the valuation of property, plant, and 
equipment ("PPE") were insufficient. Specifically - 
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• The Firm, as instructed by the principal auditor, selected for testing a 
control that consisted of management's review of the subsidiary's 
impairment memorandum and supporting documentation, including the 
underlying fair value models. The Firm's testing of this control was not 
sufficient, as the Firm limited its procedures to (1) inquiring of the control 
owner; (2) reading the impairment memorandum; (3) comparing certain 
inputs to the fair value models to supporting documentation, the fair values 
to the fair value models, and the carrying values to the general ledger; and 
(4) comparing the impairment charges to the amounts the issuer recorded. 
The Firm failed to evaluate the nature of the review procedures the control 
owner performed, including the criteria used to identify matters for follow 
up and the resolution of such matters. In addition, the Firm concluded, and 
communicated to the principal auditor, that the control was designed and 
operating effectively despite the fact that this control did not address (1) 
the reasonableness of certain significant inputs to the fair value models 
and (2) the determination of the data that should be included in the 
calculation of the carrying values of the asset groups. (AS 2201.42, and 
.44) 

• The Firm's approach for testing the valuation of PPE, including the 
impairment charges the issuer recorded, was to review and test 
management's process. The Firm, however, failed to perform sufficient 
procedures to test the impairment of PPE. Specifically, the Firm failed to 
test the reasonableness of certain significant inputs to the fair value 
models and the appropriateness of the data that were used in the 
calculation of the carrying values of the asset groups. (AS 1105.10; AS 
2502.26, .28, and .39) 

A.5. Issuer E 

In this audit of an issuer in the industrials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR. The issuer initiated and processed 
transactions related to sales and inventory at numerous locations that the issuer 
aggregated into various business units. In determining the locations at which to perform 
audit procedures, the Firm excluded a large number of locations from the scope of its 
audits, which represented a significant amount of the issuer's consolidated revenue, 
accounts receivable, and inventory. The Firm, however, failed to perform sufficient 
procedures to support its conclusion that no testing was necessary with respect to the 
out-of-scope locations. Specifically, the Firm failed to (1) consider the nature and 
amount of assets, liabilities, and transactions executed at the specific locations; (2) 
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evaluate whether specific risks of material misstatement existed at these locations; and 
(3) evaluate whether the risks of material misstatement the Firm identified for the in¬ 
scope locations also applied to the out-of-scope locations such that, in combination, 
they presented a reasonable possibility of material misstatement. In addition, the Firm 
incorrectly relied on certain entity-level controls that it tested, which it concluded did not 
operate at a level of precision that would prevent or detect material misstatements, to 
reach its conclusion that no testing was necessary at the out-of-scope locations. (AS 
2101.11-.12; AS 2201.B11; AS 2301.08) 

A.6. Issuer F 

In this audit of an issuer that provided insurance services and is in the financials 
industry sector, the Firm failed in the following respects to obtain sufficient appropriate 
audit evidence to support its audit opinions on the financial statements and on the 
effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures related to the majority of 
the issuer's total revenue. Specifically - 

o The issuer processed a significant portion of this revenue through 
production systems that were reconciled monthly to the general 
ledger. While the Firm tested controls over these reconciliations, it 
failed to identify and test any controls over the accuracy and 
completeness of the revenue data entered into the production 
systems. In addition, the Firm selected for testing three controls 
that consisted of reviews of certain revenue and accounts 
receivable information. As a result of the deficiency discussed 
above, the Firm's testing of these controls was also insufficient 
because the controls relied on the effectiveness of the monthly 
reconciliation controls with respect to the accuracy and 
completeness of the revenue and accounts receivable information. 
(AS 2201.39) 

o The Firm designed certain of its substantive procedures - including 
the sample sizes used in those procedures - based on a level of 
control reliance that was not supported due to the deficiencies in 
the Firm's testing of the controls that are discussed above. As a 
result, certain of the sample sizes the Firm used in its testing of this 
significant portion of revenue, which was performed as of an interim 
date, were too small to provide sufficient evidence. (AS 2301.16, 
.18, and .37; AS 2315.19, .23, and .23A) 
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o The Firm performed analytical procedures to test this revenue for 
the four months between the interim date and year end. To test the 
first of these four months, the Firm compared the actual revenue to 
the revenue for the previous two months. To test the last three 
months of the year, the Firm developed an expectation using 
revenue for the previous three years and the first nine months of 
the current year. These analytical procedures provided little to no 
substantive assurance, as the Firm failed to (1) establish a 
threshold for investigation of differences for the test of the first 
month and (2) evaluate whether the historical information could be 
expected to be predictive of the current-year amounts for the test of 
the last three months. (AS 2305.05, .13-. 14, and .20) 

• The Firm's procedures related to the valuation of insurance reserves 

were insufficient. Specifically - 

o The issuer determined the valuation of its insurance reserves using 
historical data for claims paid. The Firm failed to identify and test 
any controls to address whether the current and historical claims 
settlements provided an appropriate basis to estimate future losses 
on existing and future claims. (AS 2201.39) 

o The Firm's approach for testing the valuation of the insurance 
reserves was to review and test management's process. The Firm, 
however, failed to perform sufficient procedures to test the historical 
data for claims paid. Specifically, the Firm limited its procedures to 
comparing recorded payment amounts for a sample of paid claims 
to claim transmittal reports and issued checks, without evaluating 
whether the current and historical claims settlements provided an 
appropriate basis to estimate future losses on existing and future 
claims. (AS 2501.11) 

A.7. Issuer G 

In this audit of an issuer in the consumer discretionary industry sector, the Firm 
failed in the following respects to obtain sufficient appropriate audit evidence to support 
its audit opinions on the financial statements and on the effectiveness of ICFR - 


The issuer amortized certain definite-lived intangible assets using 
accelerated methods. The Firm's procedures related to these intangible 
assets were insufficient. Specifically - 
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o The Firm selected for testing a control that consisted of the review 
of the issuer's quarterly analysis of the appropriateness of the 
amortization methods used and whether these intangible assets 
were potentially impaired. The Firm failed to sufficiently test the 
aspect of this control that addressed the accuracy and 
completeness of an important system-generated report used in the 
operation of this control. Specifically, the Firm limited its testing of 
this aspect to observing the control owner generate the report from 
the system and comparing this report to the report that was used in 
the operation of the control. The Firm, however, failed to obtain an 
understanding of the parameters the system used to generate the 
report. (AS 2201.42 and .44) 

o The Firm failed to perform sufficient substantive procedures to test 
the valuation of these intangible assets and the related amortization 
expense. Specifically, the Firm failed to evaluate the 
reasonableness of the issuer's amortization methods and the useful 
lives assigned to these intangible assets. (AS 2501.11) 

• The issuer recorded customer discounts, which were approximately three 
times the Firm's established level of materiality, as reductions to revenue. 
The Firm, however, failed to identify and test any controls over, and to 
perform any substantive procedures to test, these discounts. (AS 2201.39; 
AS 2301.08) 

A.8. Issuer H 

In this audit of an issuer in the financials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR, as the Firm failed to perform sufficient 
procedures with respect to the ALL. Specifically - 

• The issuer used models in the valuation of the ALL. The Firm selected for 
testing a control that consisted of a committee's monitoring of the 
validation of the ALL models by other issuer personnel. The Firm failed to 
identify and test controls that sufficiently addressed the risks that the (1) 
ALL models were not appropriately developed, (2) inputs and assumptions 
into the models were no longer appropriate based on the current 
environment, and (3) models were not working as designed, as the single 
control in this area that the Firm identified and tested was not designed to 
operate at a level of precision that would prevent or detect material 
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misstatements in the valuation of the ALL, and the Firm failed to identify 
and test any other control that did so. (AS 2201.39) 

• The Firm selected for testing a control that consisted of management's 
review of the risk assessment for graded commercial loans; this review 
included determining which loans would be subject to an independent 
loan-grade review. The loan grades were an important factor in estimating 
the ALL for loans that were collectively evaluated for impairment. As part 
of its evaluation of the effectiveness of this control, the Firm assessed the 
control's scope by calculating the amount of loans that were subject to an 
independent loan grade review. In performing this calculation, the Firm 
aggregated the value of the portfolios selected for review pursuant to this 
control's operation with loans that were selected for review based on other 
criteria. This calculation resulted in the Firm including a large amount of 
loans twice, and the Firm therefore failed to evaluate appropriately the 
scope of the loan grade reviews and, specifically, whether a significant 
portion of the commercial loan portfolio that the issuer considered to be of 
a "risk priority of 'high'" was excluded from the independent loan-grade 
review. (AS 2201.42 and .44) 

• The Firm designed certain of its substantive procedures - including the 
sample size used in those procedures - based on a level of control 
reliance that was not supported due to the deficiencies in the Firm's 
testing of the control related to the assigned loan grades for commercial 
loans that is discussed above. As a result, the sample size the Firm used 
to test these loan grades was too small to provide sufficient evidence. (AS 
2301.16, .18, and .37; AS 2315.19, .23, and .23A) 

A.9. Issuer I 

In this audit of an issuer in the financials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR, as its procedures related to the ALL were 
not sufficient. Specifically - 

• The Firm selected for testing a control that consisted of the preparation 
and review of a risk assessment for graded commercial loans, including 
the determination of which loans would be subject to an independent loan- 
grade review during the year. The loan grades were an important factor in 
estimating the ALL. The Firm's testing of this control was not sufficient. 



PCAOB Release No. 104-2019-002 
Inspection of KPMG LLP 
January 24, 2019 
Page 20 

Specifically, the Firm failed to test whether all graded commercial loans 
were included in the risk assessment, which was an objective of this 
control, and, as a result, it failed to evaluate whether the control identified 
all high-risk commercial loan portfolios for consideration for the 
independent loan-grade review. (AS 2201.42 and .44) 

• The Firm designed certain of its substantive procedures - including the 
sample size used in those procedures - based on a level of control 
reliance that was not supported due to the deficiency in the Firm's testing 
of the control that is discussed above. As a result, the sample size the 
Firm used to test the appropriateness of the assigned loan grades for 
commercial loans was too small to provide sufficient evidence. (AS 
2301.16, .18, and .37; AS 2315.19, .23, and .23A) 

• The issuer used externally prepared appraisals to determine the fair value 
of the underlying collateral for collateral-dependent loans that it had 
determined to be individually impaired. For the impaired loans that the 
Firm selected for testing, the Firm failed to evaluate the reasonableness of 
certain of the significant assumptions underlying certain appraisals. (AS 
2502.26 and .28) 

A.10. Issuer J 

In this audit of an issuer in the financials industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinions on the financial statements and on the effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures with respect to AFS 
securities. Specifically - 

o The Firm selected for testing controls related to AFS securities that 
consisted of (1) the quarterly review of the initial quarter-end 
determination of fair values of these securities based on the prices 
received from external parties, including the testing of the accuracy 
and completeness of the file that contained these prices ("pricing 
file"); (2) the quarterly review of the fair value of securities for which 
the information in the pricing file met certain criteria; (3) the 
quarterly review of the categorization of the securities within the fair 
value hierarchy as set forth in Financial Accounting Standards 
Board ("FASB") Accounting Standards Codification ("ASC") Topic 
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820, Fair Value Measurement ; (4) the review of investment 
disclosures in the financial statements; and (5) various 
reconciliations between the securities sub-ledger and supporting 
documents or the general ledger. The Firm failed to perform 
sufficient procedures to test the operating effectiveness of each of 
these controls. Specifically, (1) for two of these controls, including 
the control that included the quarterly testing of the pricing file, the 
Firm tested only one instance of the operation of the controls, which 
was insufficient given the manual nature of the controls and the 
frequency with which the controls operated, and (2) for three of 
these controls that were tested as of an interim date three or more 
months before year end, the Firm failed to perform procedures to 
update that testing to the year end. In addition, certain information 
from the pricing file was used in the performance of four of these 
controls. The Firm's testing of these four controls was also 
insufficient because these controls relied on the effectiveness of the 
control that included the testing of the pricing file, which the Firm 
had insufficiently tested, as described above. (AS 2201.44 and .55) 

o The Firm designed certain of its substantive procedures - including 
the sample size used in those procedures - based on a level of 
control reliance that was not supported due to the deficiencies in 
the Firm's testing of the controls that are discussed above. As a 
result, the sample size the Firm used to test the valuation of certain 
AFS securities was too small to provide sufficient evidence. (AS 
2301.16, .18, and .37; AS 2315.19, .23, and .23A) 

The Firm failed to perform sufficient procedures with respect to the 

provision for income taxes and the related balance sheet accounts. 

Specifically - 

o The Firm selected for testing controls related to income taxes that 
included the review of (1) the effective tax rate reconciliation, (2) a 
schedule that summarized tax payments, (3) an analysis of the 
issuer's uncertain tax positions, (4) the deferred tax assets and 
liabilities roll-forward schedule, (5) a memorandum documenting 
the issuer's conclusions regarding the need to record a deferred tax 
asset valuation allowance, and (6) the overall income tax 
calculation. The Firm's procedures to test these controls were 
limited to (1) inquiring of the control owners; (2) obtaining the 
schedules and memorandum that were reviewed as part of the 
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controls, including certain supporting schedules, and noting 
signatures as evidence of review for certain of these documents; 
(3) comparing certain balances included in the schedules to 
supporting documentation and/or the general ledger; (4) reading 
the issuer's memorandum to verify that it contained the conclusions 
regarding the need to record a deferred tax asset valuation 
allowance; and (5) verifying the mathematical accuracy of certain 
calculations. These procedures were insufficient, as the Firm failed 
to evaluate the nature of the review procedures that the control 
owners performed, including the specific criteria used to identify 
matters for follow up or review and whether those matters were 
appropriately resolved. In addition, the Firm failed to (1) test the 
aspect of two of these controls that addressed the completeness of 
data used in the operation of the controls and (2) identify and test 
any controls over the completeness of the data used in the 
operation of one of the six controls and over the accuracy of certain 
significant inputs used in the operation of another of the controls. 
(AS 2201.39, .42, and .44) 

o The Firm selected for testing a control that consisted of the 
quarterly review of a schedule that summarized projected tax 
credits and tax losses related to the issuer's investments, which 
were significant inputs to the income tax provision. This control did 
not include an evaluation of the eligibility of the investments 
included in the schedule to generate tax credits, and the Firm failed 
to identify and test any other controls that did so. In addition, the 
Firm failed to test the aspect of the control that addressed the 
completeness of the data used in the operation of the control. (AS 
2201.39, .42, and .44) 

o The Firm designed certain of its substantive procedures - including 
the sample sizes used in those procedures - based on a level of 
control reliance that was not supported due to the deficiencies in 
the Firm's testing of two of the controls that are discussed above. 
As a result, the sample sizes that the Firm used to test deferred tax 
assets, deferred tax liabilities, tax credits, and tax losses were too 
small to provide sufficient evidence. (AS 2301.16, .18, and .37; AS 
2315.19, .23, and .23A) 

The Firm failed to perform sufficient procedures with respect to certain 

derivative assets and liabilities. Specifically - 
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o The issuer determined the recorded fair value of these derivatives 
based on valuations provided by an external organization. The Firm 
selected for testing two controls over these derivative assets and 
liabilities that consisted of (1) the reconciliation of the amounts 
recorded in the general ledger to the amounts in the statements 
that the external organization provided to the issuer, with 
investigation of variances over a threshold, and (2) the comparison 
of the recorded fair values to fair value estimates obtained from the 
counterparties, with investigation of variances over a threshold. The 
Firm failed to sufficiently test the operating effectiveness of these 
controls for one of the two months that it selected to test each 
control. Specifically, for the testing of the first control for that month, 
the Firm failed to evaluate whether the control owner identified all 
variances that exceeded the established threshold. For the testing 
of both controls for that month, the Firm failed to evaluate whether 
the identified variances were appropriately investigated and 
resolved. (AS 2201.44) 

o The Firm designed certain of its substantive procedures - including 
the sample sizes used in those procedures - based on a level of 
control reliance that was not supported due to the deficiencies in 
the Firm's testing of controls that are discussed above. As a result, 
the sample sizes the Firm used to test the valuation of these 
derivative assets and liabilities were too small to provide sufficient 
evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, and .23A) 

A. 11. Issuer K 

In this audit of an issuer that provided electric services and is in the utilities 
industry sector, the Firm failed in the following respects to obtain sufficient appropriate 
audit evidence to support its audit opinions on the financial statements and on the 
effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures related to commodity 
derivatives. Specifically - 

o The Firm selected for testing three controls over the existence 
and/or completeness of these derivatives. The Firm failed to 
sufficiently test these controls, as follows - 
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■ The issuer used an external organization to match the 
majority of these derivative trades to counterparty 
confirmations. One of the controls the Firm selected for 
testing consisted of (1) the issuer's derivatives system's 
electronic receipt of records of matched and unmatched 
trades from the external organization and (2) the 
investigation of any unmatched trades. The Firm failed to 
test the aspect of this control that consisted of the 
investigation of unmatched trades. (AS 2201.42 and .44) 

■ For the derivatives not subject to the control above, the Firm 

selected for testing a control that consisted of the issuer (1) 
comparing the terms of derivative trades to confirmations 
received from counterparties, (2) investigating any 

discrepancies, and (3) reviewing a report to identify any 
remaining unmatched trades. The Firm's procedures to test 
this control were limited to selecting a sample of trades from 
the total population of derivative positions and, for each 
selection, (1) comparing the trade terms to confirmations the 
issuer received from the counterparties and (2) verifying the 
derivative was appropriately designated as confirmed and 
matched within the system. These procedures were 
insufficient, as the Firm failed to determine whether its 
selections represented derivative trades that were subject to 
this control. (AS 2201.42 and .44) 

■ The third control that the Firm selected consisted of the 
review of errors related to the entry of trades into the 
derivatives system and the determination of remedial 
actions. The Firm's testing of this control was insufficient, as 
the Firm failed to identify and test any controls over the 
completeness of the population of errors that was reviewed. 
(AS 2201.39) 

The Firm failed to sufficiently test controls over the valuation and 
presentation and disclosure of a significant portion of these 
derivatives. The Firm selected for testing a control over commodity 
derivatives that consisted of (1) a comparison of prices that the 
issuer determined to the average of prices that the issuer obtained 
from external pricing services and, in the event of a difference, the 
adjustment of the recorded price to the externally obtained price 
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and (2) the assessment of the fair value leveling within the fair 
value hierarchy as set forth in FASB ASC Topic 820. In testing this 
control, the Firm limited its procedures to (1) inquiring of the control 
owner; (2) inspecting documentation used in the operation of the 
control; and (3) comparing, for a sample of derivatives, the price 
determined by the issuer to the average of the prices from the 
external pricing services. These procedures were insufficient, as 
the Firm failed to test how the control owner evaluated (1) the 
reliability of the prices obtained from the external pricing services 
and used in the operation of the control and (2) the reasonableness 
of the fair value leveling, including the criteria used to identify 
matters for follow up and whether those matters were appropriately 
resolved. (AS 2201.42 and .44) 

o For a significant category of these derivatives, the Firm failed to 
perform sufficient substantive procedures to evaluate the valuation 
and the leveling within the fair value hierarchy set forth in FASB 
ASC Topic 820. The Firm independently determined the fair value 
for a sample of these derivatives and compared those values to the 
amounts recorded by the issuer. The Firm, however, failed to obtain 
a sufficient understanding of the methods and assumptions used by 
the external pricing services to develop the prices used by the 
issuer to value the derivatives. Specifically, the Firm limited its 
procedures to obtaining confirmations of the general methods used 
by the external pricing services that did not provide information 
about the specific methods and assumptions used to develop the 
individual prices, including whether the significant inputs used to 
value these derivatives were observable or unobservable. (AS 
2502.26, .28, .40, and .43) 

The Firm failed to perform sufficient procedures related to certain revenue, 

which was multiple times the Firm's established level of materiality. 

Specifically - 

o For this revenue, the issuer provided certain of its customers a 
document outlining the contract terms and billing rates. The Firm 
selected for testing an automated control that generated this 
document upon a customer's enrollment. The Firm's procedures to 
test this control were limited to (1) inquiring of management, (2) 
inspecting the configuration of the relevant system after year end, 
and (3) selecting one customer enrollment after year end and 
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noting that the document was automatically generated and sent to 
the customer. These procedures were insufficient because the Firm 
failed to test the configuration of the system and any instances of 
the control that occurred during the year. (AS 2201.42 and .44) 

o A significant portion of this revenue involved variable billing rates. 
The Firm failed to identify and test any controls over the accuracy 
of the variable billing rates used in billing cycles after the first billing 
of a new customer. (AS 2201.39) 

o The Firm's substantive procedures to test this revenue consisted of 
tests of details for a sample of transactions. This testing was 
insufficient, as it was limited to comparing the recorded revenue to 
invoices and cash receipts, without performing any procedures to 
test that the billing rates used were consistent with customer 
contracts or the issuer's price list. (AS 2301.08) 

A.12. Issuer L 

In this audit of an issuer in the industrials industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinions on the financial statements and on the effectiveness of ICFR. The Firm failed 
to perform sufficient procedures related to certain revenue from three of the issuer's 
business units, which represented a significant portion of the issuer's total revenue. 
Specifically - 

• The controls that the Firm identified and tested over the occurrence of this 
revenue included (1) a control that consisted of the review and approval of 
customer contracts or purchase orders that, depending on the business 
unit, either exceeded a monetary threshold or contained non-standard 
terms and (2) a control that consisted of the quarterly review of revenue 
transactions that exceeded a monetary threshold and occurred during a 
specified period of days before and after quarter end. The Firm failed to 
evaluate whether the parameters the control owners used for the selection 
of transactions were appropriate to address the risk related to this 
revenue. (AS 2201.42) 

• The controls that the Firm identified and tested to address the pricing of 
certain of this revenue included controls for two business units that 
consisted of the monthly review of the comparison of the current-month 
gross margins by product line to, depending on the business unit, either 
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(1) budgeted gross margins or (2) current year-to-date and/or prior-year 
gross margins, with investigation of variances over established thresholds. 
The Firm's procedures to test these controls were insufficient, as they 
were limited to, for a sample of comparisons, testing the mathematical 
accuracy of the gross margin calculations and tracing the totals to the trial 
balance, determining whether explanations were provided for all variances 
over the controls' investigation thresholds, and inspecting signatures as 
evidence that a review had occurred. The Firm failed to evaluate (1) 
whether the budgeted, current year-to-date, and prior-year gross margins 
were appropriate bases for establishing expectations to identify matters for 
investigation and (2) the nature of the procedures performed by the control 
owners, including whether items identified for investigation were 
appropriately resolved. (AS 2201.42 and .44) 

• The Firm designed certain of its substantive procedures - including the 
sample sizes used in those procedures - based on a level of control 
reliance that was not supported due to the deficiencies in the Firm's 
testing of controls that are discussed above. As a result, certain of the 
sample sizes the Firm used to test this revenue were too small to provide 
sufficient evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, and .23A) 

A.13. Issuer M 

In this audit of an issuer in the materials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR, as its procedures related to revenue from 
the issuer's domestic operations were insufficient. Specifically - 

• The issuer priced its products using (1) for the majority of its customers, 
price lists that could be overridden by customer service representatives 
and (2) for most of the customers for one of its business segments, non¬ 
standard pricing. The Firm, however, failed to identify and test any 
controls over the pricing of revenue transactions. (AS 2201.39) 

• The Firm designed certain of its substantive procedures - including the 
sample sizes used in those procedures - based on a level of control 
reliance that was not supported due to the deficiency in the Firm's testing 
of controls that is discussed above. As a result, certain of the sample sizes 
that the Firm used to test this revenue were too small to provide sufficient 
evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, and .23A) 
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A.14. Issuer N 

In this audit of an issuer in the consumer staples industry sector, the Firm failed 
in the following respects to obtain sufficient appropriate audit evidence to support its 
audit opinion on the effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures to test controls over 
revenue at two of the issuer's business units, which represented over 75 
percent of total revenue. The Firm identified a risk related to the pricing of 
revenue transactions. With respect to the accuracy of revenue, the Firm 
selected for testing three automated controls over system access, the 
transfer of data to the general ledger, and the integrity of certain data 
related to orders. These controls, however, did not address the risk of 
incorrect pricing of revenue transactions, and the Firm failed to identify 
and test any other controls that addressed that risk. (AS 2201.39) 

• With respect to inventory at these two business units, which represented 
the majority of inventory, the Firm selected for testing controls that 
included management's review of a report to ensure that all inventory was 
counted in accordance with the issuer's cycle-count policy. The Firm's 
testing of these controls was not sufficient because (1) for inventory at the 
first business unit and certain inventory at the second business unit, the 
Firm failed to identify and test any controls over the accuracy and 
completeness of the reports used in the performance of the controls and 
(2) for the remaining inventory at the second business unit, to test controls 
over the accuracy and completeness of the report, the Firm selected only 
one instance of the report, which was insufficient because the Firm did not 
test the information technology general controls over the system that 
produced this report. (AS 2201.39, .46, and .47) 

A. 15. Issuer O 

In this audit of an issuer in the financials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR. Specifically, the Firm failed in the 
following respects to perform sufficient procedures related to two segments of the 
issuer's loan portfolio, which in the aggregate represented over 90 percent of total 
loans - 
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• The issuer placed items in a loan suspense account when the items 
needed further evaluation; certain types of transactions were initially 
placed in these accounts, as were items for which the issuer was unable 
to identify the appropriate accounts for posting. The Firm identified and 
tested a control that included a review of the issuer's loan suspense 
account reconciliations. This control, however, did not address the risk 
that items that had been cleared from the suspense accounts had not 
been appropriately resolved, and the Firm failed to identify and test any 
other controls that addressed that risk. (AS 2201.39) 

• The Firm failed to perform sufficient substantive procedures to test these 
two segments of the loan portfolio. Specifically - 

o The Firm limited its procedures to test the suspense accounts for 
these two segments of the loan portfolio to (1) comparing the 
ending balance from the reconciliations of these accounts to the 
general ledger, (2) testing the mathematical accuracy of the 
reconciliations, (3) evaluating the appropriateness of certain items 
included in the suspense accounts, and (4) observing signatures as 
evidence of review of the reconciliations. The Firm failed to test 
whether suspense items that had been cleared were appropriately 
resolved. (AS 2301.08) 

o The Firm designed certain of its substantive procedures - including 
the sample size used in those procedures - based on a level of 
control reliance that was not supported due to the deficiency in the 
Firm's testing of controls that is discussed above. As a result, the 
sample size that the Firm used to test the existence of one of the 
two segments of the loan portfolio, which represented 
approximately 18 percent of total loans, was too small to provide 
sufficient evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, 
and .23A) 

A.16. Issuer P 

In this audit of an issuer in the financials industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinion on the financial statements - 
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The issuer recorded MSRs at the lower of amortized cost or fair value. 
The Firm failed to perform sufficient procedures to test certain types of 
MSRs. Specifically - 

o The issuer determined the fair value of these MSRs by selecting 
the mid-point of a range that it developed using certain significant 
assumptions. The Firm evaluated the reasonableness of these 
assumptions by comparing them to those of peers that it selected; 
these comparisons indicated ranges of acceptable values for the 
assumptions. The Firm's procedures were insufficient, as follows - 

■ The Firm obtained wide ranges of values for the selected 
peers. The Firm failed to evaluate whether the peers were 
sufficiently comparable to the issuer to provide a relevant 
indicator of the fair value of the issuer's MSRs. (AS 2502.26 
and .28) 

■ The issuer's amount for one of the assumptions fell outside 
the Firm's range. To evaluate this outlier, the Firm calculated 
a revised fair value of these MSRs using the mid-point of its 
range for this assumption and determined that the resulting 
fair value was within the issuer's fair value range. The Firm, 
however, failed to perform any procedures to evaluate 
whether the issuer's range was an appropriate expectation to 
evaluate this assumption. (AS 2502.26 and .28) 

o The Firm failed to test the amortized cost of these MSRs. (AS 
2501.07) 

The Firm failed to perform sufficient procedures to test deposit liabilities. 
Specifically, the Firm sent positive confirmation requests to the issuer's 
customers for a sample of deposit accounts. The Firm failed to perform 
sufficient alternative procedures for the confirmations that were not 
returned, as these procedures were limited to comparing certain 
information from the confirmation requests to customer statements that 
were generated from the system that had also been used to generate the 
confirmation requests. (AS 2310.31) 
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A. 17. Issuer Q 

In this audit of an issuer in the financials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinion on the effectiveness of 
ICFR, as it failed to perform sufficient procedures with respect to deposits. The issuer's 
deposit accounts reflected transaction data transmitted to the issuer from various 
external service providers. The Firm failed to identify and test any controls over the 
completeness and accuracy of these data. (AS 2201.39) 

A.18. Issuer R 

In this audit of an issuer in the energy industry sector, the Firm failed in the 
following respects to obtain sufficient appropriate audit evidence to support its audit 
opinions on the financial statements and on the effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures related to the valuation of 
property, plant, and equipment. Specifically - 

o The Firm selected for testing a control that consisted of 
management's quarterly review of a list of asset groups with 
forecasted negative operating results ("the watch list") to identify 
indicators of possible impairment. The issuer had lost its sole 
customer for one of its asset groups in the prior year, which 
resulted in no revenue and negative operating results for this asset 
group for the past two years. This asset group was not included on 
the watch list. The Firm failed to take into consideration, when 
evaluating the effectiveness of the control, the omission of this 
asset group from the watch list. (AS 2201.42 and .44) 

o The Firm failed to perform sufficient substantive procedures to test 
for possible impairment the asset group described above, as it 
limited its procedures to inquiring of management regarding the 
issuer's rationale for concluding that an impairment indicator did not 
exist and reviewing legal letters from internal and external counsel 
about the status of pending litigation with the sole customer. The 
Firm, however, failed to perform any procedures to evaluate the 
reasonableness of management's assertion that the asset group 
would generate positive cash flow. (AS 2301.08) 

• The Firm failed to perform sufficient procedures to test controls over the 
assessment of the possible impairment of a significant loan receivable. 
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Specifically, the Firm failed to identify and test any controls that addressed 
whether any impairment indicators that existed between the dates of the 
issuer's annual impairment analysis for the loan receivable were identified 
on a timely basis. (AS 2201.39) 

A.19. Issuer S 

In this audit of an issuer in the materials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinion on the effectiveness of 
ICFR. Specifically, the Firm failed in the following respects to perform sufficient 
procedures to test controls over the issuer's three types of inventory - 

• The Firm selected for testing two controls over the valuation of one type of 
inventory that consisted of the monthly reviews of (1) the calculation of the 
cost of goods produced for this inventory and (2) the lower-of-cost-or- 
market analysis. The Firm's testing of the first control was insufficient, as 
the Firm failed to test the aspect of this control that addressed the 
accuracy of certain significant inputs to the calculation. As a result of this 
deficiency, the Firm's testing of the second control was also insufficient 
because this control relied on the effectiveness of the first control, as the 
cost of goods produced was a significant input to the lower-of-cost-or- 
market analysis. (AS 2201.42 and .44) 

• The Firm selected for testing a control over another type of inventory that 
consisted of the review of the month-end inventory calculation. The Firm 
failed to test the aspect of this control that addressed the accuracy of 
certain significant inputs to the calculation of this inventory. (AS 2201.42 
and .44) 

• The Firm selected for testing an automated control over the cost for all 
three types of inventory that consisted of a three-way match among the 
purchase order, receiving document, and vendor invoice or a two-way 
match between the purchase order and vendor invoice. The system 
performed the match in accordance with certain preconfigured thresholds 
before approving payment of the invoice. The Firm failed to sufficiently test 
this control, as its procedures were limited to (1) inquiring of IT personnel, 
(2) observing in the system the thresholds used for the match and 
evaluating them for reasonableness, and (3) verifying for two vendor 
invoices that the underlying information was within the preconfigured 
thresholds and that the system performed the match before approving 
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payment of the invoices. The Firm's procedures, however, did not include 
testing whether the system prevented the payment of invoices that did not 
match. In addition, the Firm failed to identify and test any controls that 
addressed the resolution of items that did not match within the 
preconfigured thresholds. (AS 2201.39, .42, and .44) 

• The Firm selected for testing a control over payroll costs, which were a 
significant input to the determination of the cost of goods produced for two 
types of inventory. This control consisted of (1) the review of the service 
auditor's reports provided by the service organization that the issuer used 
to perform its payroll function and (2) the documentation of the necessary 
user controls specified in the service auditor's reports. The Firm, however, 
did not test the issuer's control over the accuracy and completeness of 
payroll data transmitted by the issuer to the service organization that was 
identified as a necessary user control in the service auditor's reports. (AS 
2201.B22) 

A.20. Issuer T 

In this audit of a manufacturer and distributor of consumer products in the 
consumer staples industry sector, the Firm failed in the following respects to obtain 
sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR - 

• The Firm failed to perform sufficient procedures related to the allowances 
for sales returns and sales markdowns, as follows - 

o The issuer determined its allowance for sales returns based on 
processed customer returns. For one of the issuer's business units, 
the Firm selected for testing a control consisting of the review and 
approval of credit memoranda for processed customer returns. This 
control included the comparison of inventory returns to customer 
claims. The Firm failed to test this aspect of the control, and the 
Firm failed to identify and test any other controls that addressed the 
risk that the processed customer returns data were not accurate. 
(AS 2201.39) 

For another of the issuer's business units, which was acquired 
during the year, the Firm's testing of the allowances for sales 
returns and sales markdowns consisted solely of analytical 
procedures. These analytical procedures, however, provided little to 


o 
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no substantive assurance. For these procedures, the Firm 
calculated the average ratio for the prior two years of the allowance 
amounts to accounts receivable and applied this ratio to the 
current-year accounts receivable to determine its expectation for 
the current-year allowance amounts. The Firm, however, failed to 
establish appropriate expectations, as it failed to obtain evidence 
that the prior-years' ratios would be predictive of the current-year 
amounts. (AS 2305.13 and .14) 

The Firm failed to perform sufficient procedures related to inventory, as 

follows - 

o A significant portion of the issuer's inventory was located in one 
warehouse. The Firm selected for testing a control over the 
existence of this inventory. The control required that 80 percent of 
the inventory storage locations at this warehouse be counted at 
least once a year. The Firm failed to evaluate whether this control 
was designed to appropriately address the risk related to the 
existence of inventory. Specifically, the Firm did not evaluate 
whether this control, which required that only 80 percent of the 
inventory storage locations be counted, could effectively prevent or 
detect material misstatement of the inventory located in this 
warehouse. (AS 2201.42) 

o The Firm designed certain of its substantive procedures - including 
the sample size used in those procedures - based on a level of 
control reliance that was not supported due to the deficiency in the 
Firm's testing of the control that is discussed above. As a result, the 
sample size the Firm used to test the existence of this inventory 
was too small to provide sufficient evidence. (AS 2301.16, .18, and 
.37; AS 2315.19, .23, and .23A) 

o To determine the allowance for excess and obsolete inventory for 
one of its components, the issuer applied a different reserve 
percentage to each of the categories within its two types of 
inventory. The Firm failed to perform sufficient testing of this 
allowance. Specifically - 

■ For both types of inventory, the Firm failed to test the 
completeness of the inventory included in each of the 
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categories used in the calculation of the allowance. (AS 
2501.11) 

For one type of inventory, the Firm failed to evaluate the 
reasonableness of the reserve percentages that the issuer 
applied to the categories in determining the allowance. (AS 
2501.11) 


A.21. Issuer U 

In this audit of an issuer in the real estate industry sector, the Firm failed to 
obtain sufficient appropriate audit evidence to support its audit opinions on the financial 
statements and on the effectiveness of ICFR, as it failed to perform sufficient 
procedures related to certain revenue, which was multiple times the Firm's established 
level of materiality. Specifically - 

• The Firm selected for testing a control over this revenue that consisted of 
(1) the comparison, by contract, of accrued revenue for the current month 
to both accrued revenue for the prior month and amounts invoiced during 
the current month and (2) the investigation of variances over an 
established threshold. The Firm's procedures to test the operating 
effectiveness of this control consisted of (1) inspecting the comparisons 
for two months and verifying that explanations were provided for all 
variances over the established threshold and (2) obtaining corroboration of 
the control owner's explanations for a small number of the hundreds of 
variances for each month selected that exceeded the threshold. The 
Firm's testing of this control, however, was insufficient as the Firm failed to 
obtain sufficient evidence to conclude that the control operated effectively. 
Specifically, the Firm's sample to test this control was too small in light of 
the frequency that the control operated. (AS 2201.46 and .47) 

• The Firm designed certain of its substantive procedures - including the 
sample sizes used in those procedures - based on a level of control 
reliance that was not supported due to the deficiency in the Firm's testing 
of the control that is discussed above. As a result, the sample sizes the 
Firm used to test this revenue were too small to provide sufficient 
evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, and .23A) 
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A.22. Issuer V 

In this audit of an issuer in the industrials industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinion on the effectiveness of 
ICFR, as it failed to sufficiently test controls over the valuation of goodwill and intangible 
assets. The Firm selected for testing a control that consisted of the preparation and 
review of the issuer's quarterly qualitative analysis of the possible impairment of 
goodwill and intangible assets. The Firm's procedures to test this control were limited to 
inquiring of the control owners; reading a narrative describing the issuer's process for 
assessing impairment; obtaining the issuer's impairment memorandum for two quarters 
and tracing certain amounts from one of these memoranda to supporting 
documentation; and, for one quarter, obtaining the control owner's review comments as 
evidence that the review had occurred. The Firm failed to evaluate the nature of the 
review procedures performed, including the criteria the control owner used to identify 
matters for follow up and whether those matters were appropriately resolved. (AS 
2201.42 and .44) 

A.23. Issuer W 

In this audit of an issuer in the information technology industry sector, the Firm 
failed to obtain sufficient appropriate audit evidence to support its audit opinions on the 
financial statements and on the effectiveness of ICFR, as it failed to perform sufficient 
procedures related to the existence of inventories at certain of the issuer's locations. 
Specifically - 

• The Firm identified and tested one control over the existence of these 
inventories. This cycle-count control was designed to count all raw 
materials and 40 percent of the value of work-in-process and finished 
goods inventories at these locations at least once a year. The values of 
the work-in-process and finished goods inventories not subject to this 
cycle-count control at these locations were, in the aggregate, multiple 
times the Firm's established level of materiality. The Firm failed to 
evaluate whether this control, which required that only 40 percent of the 
value of work-in-process and finished goods inventories be counted, could 
effectively prevent or detect material misstatement of this inventory. (AS 
2201.42) 

• The Firm designed certain of its substantive procedures - including the 
sample sizes used in those procedures - based on a level of control 
reliance that was not supported due to the deficiency in the Firm's testing 
of controls that is discussed above. As a result, certain of the sample sizes 
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the Firm used to test these inventories were too small to provide sufficient 
evidence. (AS 2301.16, .18, and .37; AS 2315.19, .23, and .23A) 

A.24. Issuer X 

In this audit of an issuer in the health care industry sector, the Firm failed to 
obtain sufficient appropriate audit evidence to support its audit opinion on the 
effectiveness of ICFR. The Firm identified a deficiency in the control that it tested over 
two types of revenue; this revenue was, in the aggregate, multiple times the Firm's 
established level of materiality. The Firm identified and tested a compensating control, 
but it determined that this control was ineffective and that the deficiency in the first 
control was unremediated as of the year end. The Firm failed to sufficiently evaluate the 
severity of the deficiency in the first control, as it failed to include the more significant of 
the two revenue types in its evaluation of the magnitude of the potential misstatement 
resulting from this deficiency. (AS 2201.62) 

A.25. Issuer Y 

In this audit of an issuer in the energy industry sector, the Firm failed to obtain 
sufficient appropriate audit evidence to support its audit opinion on the financial 
statements, as its procedures to test revenue were not sufficient. The Firm documented 
that the issuer had accepted financial instruments from a significant customer in 
exchange for accounts receivable due from that customer, that it had recorded 
significant losses on those financial instruments, and that it may accept similar financial 
instruments in the future. The Firm, however, failed to evaluate, in light of these 
circumstances, whether the issuer had met the revenue recognition criterion that the 
price was fixed and determinable for sales to this customer. (AS 2810.03) 

A.26. Issuer Z 

In this audit of an issuer in the information technology industry sector, the Firm 
failed to obtain sufficient appropriate audit evidence to support its audit opinion on the 
effectiveness of ICFR. During the year, the issuer repurchased certain of its convertible 
notes and recognized a loss on the repurchase. The Firm identified a control over this 
transaction that consisted of management's review of the accounting for non-routine 
transactions and, to test the operating effectiveness of this control, it selected the 
repurchase of the convertible notes. The Firm's testing of the effectiveness of this 
control was not sufficient, as the Firm did not identify, and take into account, that the 
control owner had failed to detect that the issuer had not appropriately determined the 
amount of the loss on the repurchase of the convertible notes in accordance with FASB 
ASC Subtopic 470-20, Debt with Conversion and Other Options. (AS 2201.44) 
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B. Auditing Standards 

Each deficiency described in Part I.A above could relate to several provisions of 
the auditing standards that govern the conduct of audits. The paragraphs of the 
standards that are cited in Part I.A for each deficiency are only those that most directly 
relate to the deficiency. The deficiencies also may relate, however, to other paragraphs 
of those standards and to other auditing standards, including those concerning due 
professional care, responses to risk assessments, and audit evidence. 

Many audit deficiencies involve a lack of due professional care. Paragraphs .02, 
.05, and .06 of AS 1015, Due Professional Care in the Performance of Work, require the 
independent auditor to plan and perform his or her work with due professional care and 
set forth aspects of that requirement. AS 1015.07-.09, and paragraph .07 of AS 2301, 
The Auditor's Responses to the Risks of Material Misstatement, specify that due 
professional care requires the exercise of professional skepticism. These standards 
state that professional skepticism is an attitude that includes a questioning mind and a 
critical assessment of the appropriateness and sufficiency of audit evidence. 

AS 2301.03, .05, and .08 require the auditor to design and implement audit 
responses that address the risks of material misstatement. Paragraph .04 of AS 1105, 
Audit Evidence, requires the auditor to plan and perform audit procedures to obtain 
sufficient appropriate audit evidence to provide a reasonable basis for the audit opinion. 
Sufficiency is the measure of the quantity of audit evidence, and the quantity needed is 
affected by the risk of material misstatement (in the audit of financial statements) or the 
risk associated with the control (in the audit of ICFR) and the quality of the audit 
evidence obtained. Appropriateness is the measure of the quality of audit evidence; to 
be appropriate, evidence must be both relevant and reliable in providing support for the 
related conclusions. 

B.1. List of Specific Auditing Standards Referenced in Part I.A 

The table below lists the specific auditing standards that are referenced in Part 
I.A of this report, cross-referenced to the issuer audits for which each standard is cited. 
For each auditing standard, the table also provides the number of distinct deficiencies 
for which the standard is cited for each of the relevant issuer audits. This information 
identifies only the number of times that the standard is referenced, regardless of 
whether the reference includes multiple paragraphs or relates to multiple financial 
statement accounts. 
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PCAOB Auditing Standards 

Audits 

Number of 



References 
per Audit 

AS 1105, Audit Evidence 

Issuer D 

1 

AS 2101, Audit Planning 

Issuer E 

1 

AS 2110, Identifying and Assessing Risks of 
Material Misstatement 

Issuer A 

1 

AS 2201, An Audit of Internal Control Over 

Issuer A 

4 

Financial Reporting That Is Integrated with An 

Issuer B 

3 

Audit of Financial Statements 

Issuer C 

4 


Issuer D 

1 


Issuer E 

1 


Issuer F 

2 


Issuer G 

2 


Issuer H 

2 


Issuer 1 

1 


Issuer J 

4 


Issuer K 

6 


Issuer L 

2 


Issuer M 

1 


Issuer N 

2 


Issuer O 

1 


Issuer Q 

1 


Issuer R 

2 


Issuer S 

4 


Issuer T 

2 


Issuer U 

1 


Issuer V 

1 


Issuer W 

1 


Issuer X 

1 


Issuer Z 

1 

AS 2301, The Auditor's Responses to the 

Issuer A 

2 

Risks of Material Misstatement 

Issuer B 

2 


Issuer C 

1 


Issuer E 

1 


Issuer F 

1 
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PCAOB Auditing Standards 



AS 2305, Substantive Analytical Procedures 


AS 2310, The Confirmation Process 


AS 2315, Audit Sampling 


AS 2501, Auditin g Acco unting Estimates 


Audits 

Number of 
References 
per Audit 

Issuer G 

1 

Issuer H 

1 

Issuer 1 

1 

Issuer J 

3 

Issuer K 

1 

Issuer L 

1 

Issuer M 

1 

Issuer O 

2 

Issuer R 

1 

Issuer T 

1 

Issuer U 

1 

Issuer W 

1 

Issuer F 

1 

Issuer T 

1 

Issuer B 

2 

Issuer P 

1 

Issuer A 

2 

Issuer B 

1 

Issuer C 

1 

Issuer F 

1 

Issuer H 

1 

Issuer 1 

1 

Issuer J 

3 

Issuer L 

1 

Issuer M 

1 

Issuer O 

1 

Issuer T 

1 

Issuer U 

1 

Issuer W 

1 

Issuer A 

1 

Issuer B 

1 

Issuer C 

1 

Issuer F 

1 
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PCAOB Auditing Standards 



AS 2502, Auditing Fair Value Measurements 
and Disclosures 


AS 2810, Evaluating Audit Results 


Audits 

Number of 
References 
per Audit 

Issuer G 

1 

Issuer P 

1 

Issuer T 

2 

Issuer A 

1 

Issuer D 

1 

Issuer 1 

1 

Issuer K 

1 

Issuer P 

2 

Issuer Y 

1 


B.2. Financial Statement Accounts or Auditing Areas Related to Identified Audit 
Deficiencies 

The table below lists the financial statement accounts or auditing areas related to 
the deficiencies included in Part I.A of this report and identifies the audits described in 
Part I.A where deficiencies relating to the respective areas were observed. 



Accounts 

receivable 


AFS 

securities 


Business 

combinations 


Convertible 

notes 


Deposit 

liabilities 


Derivative 
assets and 
liabilities 


Income taxes 




AS 

1105 

AS 

2101 

AS 

2110 

AS 

2201 

AS 

2301 

AS 

2305 

AS 

2310 

AS 

2315 

■ 

■ 

■1 

E 

■ 





A 

A, C, 

A, J 



A, J 








■I 



A A, B, A, B 

Q 

A A, J, A, J 

K 


H 









A, B 
A, J 





■I 






K 
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AS 

AS 

AS 

AS 

AS 

AS 

AS 

AS 

AS 

AS 

AS 

1105 

2101 

2110 

2201 

2301 

2305 

2310 

2315 

2501 

2502 

2810 


Impairment of 
goodwill and 
intangible 
assets 


Impairment of 
PP&E 


Impairment of 
loan 

receivables 


Insurance 

reserves 


Intangible 

assets, 

including 

amortization 


Inventory, 

including 

related 

reserves 


Loans, 

including ALL 


MSRs 


Revenue, 

including 

allowances 


■ 



V 




D, R 






R 



■I 




E, N, 

S, T, 
W 

E, T, 

W 

A, B, 

c, 

H, 1, 

O 

A, C, 

H, 1, 

O 

A 


E, F, 

E, F, 

G, 

G, 

K, L, 

K, L, 

M, 

M, U 

N, T, 


U,X 








■ 











B A, C, A, B, I 
H, I, C 
O 


F, L, 

M, U 


Y 
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B.3. Audit Deficiencies by Industry 

The table below lists the industries 5 of the issuers for which audit deficiencies 
were discussed in Part I .A of this report and cross references the issuers to the specific 
auditing standards related to the deficiencies. 



0 The majority of industry sector data is based on Global Industry 
Classification Standard ("GICS") data obtained from Standard & Poor's ("S&P"). In 
instances where GICS for an issuer is not available from S&P, classifications are 
assigned based upon North American Industry Classification System data. 
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C. Data Related to the Issuer Audits Selected for Inspection 6 

C. 1. Industries of Issuers Inspected 

The chart below categorizes the 52 issuers whose audits were inspected in 2017, 
based on the issuer's industry. 7 


Industries of Issuers Inspected 


Telecommuni¬ 
cation 
Services. 2% 


Utilities, 2% 


Consumer 

Discretionary, 

4% 


Real Estate 
2 % 


Materials, 8%_ 


Information 

Technology, 

11 % 


Industrials, 

15% 



Consumer 
Staples, 4% 


Energy, 11% 


Health Care, y 
14% 


Financials, 

27% 


Industry 

Number 
of Audits 
Inspected 

Percentage 

Consumer 

Discretionary 

2 

4% 

Consumer Staples 

2 

4% 

Energy 

6 

11% 

Financials 

14 

27% 

Health Care 

■ 7 ■ 

14% 

Industrials 

8 

15% 

Information 

Technology 

6 

11% 

Materials 

4 

8% 

Real Estate 

1 

2% 

Telecommunication 

Services 

1 

2% 

Utilities 

■ 1 ■ 

2% 

Total 

52 

100% 


0 Where the audit work inspected related to an engagement in which the 
Firm played a role but was not the principal auditor, the industry and the revenue 
included in the tables and charts in this section are those of the entity for which an audit 
report was issued by the primary auditor. As discussed above, the inspection process 
included reviews of portions of 51 selected issuer audits completed by the Firm and the 
Firm's audit work on one other issuer audit engagement in which it played a role but 
was not the principal auditor. 

' See Footnote 5 for additional information on how industry sectors were 
classified. 
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C.2. Revenue Ranges of Issuers Inspected 

The chart below categorizes, based upon revenue, the 52 issuers whose audits 
were inspected in 2017. 8 This presentation of revenue data is intended to provide 
information related to the size of issuers whose audits were inspected and is not 
indicative of whether the inspection included a review of the Firm's auditing of revenue 
in the issuer audits selected for review. 



Revenue Ranges of Issuers 
Inspected 


>$10 billion - 
$50 billion 
11 % 


0-$100 

million 

6 % 


>$5 billion - 
$10 billion 
11 % 


>$100 million 
- $500 million 
29% 


> $50 billion 
6 % 


>$1 billion - 
$2.5 billion 
21 % 


>$2.5 billion 
$5 billion 
8 % 


Revenue 
(in US$) 

Number 
of Audits 
inspected 

Percentage 

<100 million 

3 

6% 

100-500 

million 

15 

29% 

>500 million 
|-1 billion 

4 

8% 

>1-2.5 billion 

11 

21% 

>2.5-5 billion 

4 

8% 

>5-10 billion 

6 

11% 

>10-50 billion 

6 

11% 

>50 billion 

3 

6% 

fTotal 

52 

100% 


° The revenue amounts reflected in the chart are for the issuer's fiscal year 
end that corresponds to the audit inspected by the PCAOB. The revenue amounts were 
obtained from S&P and reflect a standardized approach to presenting revenue amounts. 
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D. Information Concerning PCAOB Inspections that is Generally Applicable to 

Annually Inspected Firms 

This section provides a brief description of the procedures that are often 
performed in annual inspections of auditing firms. 

D.l. Reviews of Audit Work 

The inspection team selects the audits, and the specific portions of those audits, 
that it will review, and the inspected firm is not allowed an opportunity to limit or 
influence the selections. For each specific portion of the audit that is selected, the 
inspection team reviews the engagement team's work papers and interviews 
engagement personnel regarding those portions. If the inspection team identifies a 
potential issue that it is unable to resolve through discussion with the firm and review of 
any additional work papers or other documentation, the inspection team ordinarily 
provides the firm with a written comment form on the matter and the firm is allowed the 
opportunity to provide a written response to the comment form. If the response does not 
resolve the inspection team's concerns, the matter is considered a deficiency and is 
evaluated for inclusion in the inspection report. Identified deficiencies in the audit work 
that exceed a significance threshold (which is described in Part I .A of the inspection 
report) are summarized in the public portion of the inspection report. 9 

Audit deficiencies that the inspection team may identify include a firm's failure to 
identify, or to address appropriately, financial statement misstatements, including 
failures to comply with disclosure requirements, 10 as well as a firm's failure to perform, 


The discussion in this report of any deficiency observed in a particular 
audit reflects information reported to the Board by the inspection team and does not 
reflect any determination by the Board as to whether the Firm has engaged in any 
conduct for which it could be sanctioned through the Board's disciplinary process. In 
addition, any references in this report to violations or potential violations of law, rules, or 
professional standards are not a result of an adjudicative process and do not constitute 
conclusive findings for purposes of imposing legal liability. 

10 When it comes to the Board's attention that an issuer's financial 
statements appear not to present fairly, in a material respect, the financial position, 
results of operations, or cash flows of the issuer in conformity with the applicable 
financial reporting framework, the Board's practice is to report that information to the 
Securities and Exchange Commission ("SEC" or "the Commission"), which has 
jurisdiction to determine proper accounting in issuers' financial statements. Any 
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or to perform sufficiently, certain necessary risk assessment procedures, tests of 
controls, and substantive audit procedures. 

In reaching its conclusions about whether a deficiency exists, an inspection team 
considers whether audit documentation or any other evidence that a firm might provide 
to the inspection team supports the firm's contention that it performed a procedure, 
obtained evidence, or reached an appropriate conclusion. In some cases, the 
conclusion that a firm did not perform a procedure may be based on the absence of 
documentation and the absence of persuasive other evidence, even if the firm claimed 
to have performed the procedure. AS 1215, Audit Documentation, provides that, in 
various circumstances including PCAOB inspections, a firm that has not adequately 
documented that it performed a procedure, obtained evidence, or reached an 
appropriate conclusion must demonstrate with persuasive other evidence that it did so, 
and that oral assertions and explanations alone do not constitute persuasive other 
evidence. In the case of every matter cited in the public portion of a final inspection 
report, the inspection team has carefully considered any contention by the firm that it did 
so but just did not document its work, and the inspection team has concluded that the 
available evidence does not support the contention that the firm sufficiently performed 
the necessary work. 

D.2. Review of a Firm's Quality Control System 

QC 20, System of Quality Control for a CPA Firm's Accounting and Auditing 
Practice, provides that an auditing firm has a responsibility to ensure that its personnel 
comply with the applicable professional standards. This standard specifies that a firm's 
system of quality control should encompass the following elements: (1) independence, 
integrity, and objectivity; (2) personnel management; (3) acceptance and continuance of 
issuer audit engagements; (4) engagement performance; and (5) monitoring. 

The inspection team's assessment of a firm's quality control system is derived 
both from the results of its procedures specifically focused on the firm's quality control 
policies and procedures, and also from inferences that can be drawn from deficiencies 
in the performance of individual audits. Audit deficiencies, whether alone or when 
aggregated, may indicate areas where a firm's system has failed to provide reasonable 


description in this report of financial statement misstatements or failures to comply with 
SEC disclosure requirements should not be understood as an indication that the SEC 
has considered or made any determination regarding these issues unless otherwise 
expressly stated. 
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assurance of quality in the performance of audits. Even deficiencies that do not result in 
an insufficiently supported audit opinion or a failure to obtain sufficient appropriate audit 
evidence to fulfill the objectives of the firm's role in an audit may indicate a defect or 
potential defect in a firm's quality control system. 11 If identified deficiencies, when 
accumulated and evaluated, indicate defects or potential defects in the firm's system of 
quality control, the nonpublic portion of this report would include a discussion of those 
issues. When evaluating whether identified deficiencies in individual audits indicate a 
defect or potential defect in a firm's system of quality control, the inspection team 
considers the nature, significance, and frequency of the deficiencies; 12 related firm 
methodology, guidance, and practices; and possible root causes. 

Inspections also include a review of certain of the firm's practices, policies, and 
processes related to audit quality, which constitute a part of the firm's quality control 
system. The inspection team customizes the procedures it performs with respect to the 
firm's practices, policies, and processes related to audit quality, bearing in mind the 
firm's structure, procedures performed in prior inspections, past and current inspection 
observations, an assessment of risk related to each area, and other factors. The areas 
generally considered for review include (1) management structure and processes, 
including the tone at the top; (2) practices for partner management, including allocation 
of partner resources and partner evaluation, compensation, admission, and disciplinary 
actions; (3) policies and procedures for considering and addressing the risks involved in 
accepting and retaining issuer audit engagements, including the application of the firm's 
risk-rating system; (4) processes related to the firm's use of audit work that the firm's 
foreign affiliates perform on the foreign operations of the firm's U.S. issuer audits; and 
(5) the firm's processes for monitoring audit performance, including processes for 
identifying and assessing indicators of deficiencies in audit performance, independence 
policies and procedures, and processes for responding to defects or potential defects in 


1 Not every audit deficiency suggests a defect or potential defect in a firm's 
quality control system, and this report does not discuss every audit deficiency the 
inspection team identified. 

IZ An evaluation of the frequency of a type of deficiency may include 
consideration of how often the inspection team reviewed audit work that presented the 
opportunity for similar deficiencies to occur. In some cases, even a type of deficiency 
that is observed infrequently in a particular inspection may, because of some 
combination of its nature, its significance, and the frequency with which it has been 
observed in previous inspections of the firm, be cause for concern about a quality 
control defect or potential defect. 
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quality control. A description of the procedures generally applied to these areas is 
below. 


D.2.a. Review of Management Structure and Processes, Including the 
Tone at the Top 

Procedures in this area are designed to focus on (1) how management is 
structured and operates the firm's business, and the implications that the management 
structure and processes have on audit performance and (2) whether actions and 
communications by the firm's leadership - the tone at the top - demonstrate a 
commitment to audit quality. To assess this area, the inspection team may interview firm 
personnel, including firm leadership, and review significant management reports, 
communications, and documents, as well as information regarding financial metrics and 
other processes that the firm uses to plan and evaluate its business. 

D.2.b. Review of Practices for Partner Management, Including 
Allocation of Partner Resources and Partner Evaluation, 
Compensation, Admission, and Disciplinary Actions 

Procedures in this area are designed to focus on (1) whether the firm's processes 
related to partner evaluation, compensation, admission, termination, and disciplinary 
actions could be expected to encourage an appropriate emphasis on audit quality and 
technical competence, as distinct from marketing or other activities of the firm; (2) the 
firm's processes for allocating its partner resources; and (3) the accountability and 
responsibilities of the different levels of firm management with respect to partner 
management. The inspection team may interview members of the firm's management 
and review documentation related to certain of these topics. In addition, the inspection 
team's evaluation may include the results of interviews of audit partners regarding their 
responsibilities and allocation of time. Further, the inspection team may review a sample 
of partners' personnel files. 

D.2.c. Review of Policies and Procedures for Considering and 
Addressing the Risks Involved in Accepting and Retaining 
Issuer Audit Engagements, Including the Application of the 
Firm's Risk-Rating System 

The inspection team may consider the firm's documented policies and 
procedures in this area. In addition, the inspection team may select certain issuer audits 
to (1) evaluate compliance with the firm's policies and procedures for identifying and 
assessing the risks involved in accepting or continuing the issuer audit engagements 
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and (2) observe whether the audit procedures were responsive to the risks of material 
misstatement identified during the firm's process. 

D.2.d. Review of Processes Related to a Firm's Use of Audit Work that 
the Firm's Foreign Affiliates Perform on the Firm's U.S. Issuer 
Audits 


The inspection team may review the firm's policies and procedures related to its 
supervision and control of work performed by foreign affiliates on the firm's U.S. issuer 
audits, review available information relating to the most recent internal inspections of 
foreign affiliated firms, interview members of the firm's leadership, and review the U.S. 
engagement teams' supervision concerning, and procedures for control of, the audit 
work that the firm's foreign affiliates performed on a sample of audits. 

D.2.e. Review of a Firm's Processes for Monitoring Audit Performance, 
Including Processes for Identifying and Assessing Indicators of 
Deficiencies in Audit Performance, Independence Policies and 
Procedures, and Processes for Responding to Defects or 
Potential Defects in Quality Control 

D.2.e.i. Review of Processes for Identifying and Assessing 
Indicators of Deficiencies in Audit Performance 


Procedures in this area are designed to identify and assess the processes the 
firm uses to monitor audit guality for individual engagements and for the firm as a whole. 
The inspection team may interview members of the firm's management and review 
documents relating to the firm's identification and evaluation of, and response to, 
possible indicators of deficiencies in audit performance. In addition, the inspection team 
may review documents related to the design and operation of the firm's internal 
inspection program, and may compare the results of its review to those from the internal 
inspection's review of the same audit work. 

D.2.e.ii. Review of Response to Defects or Potential Defects in 
Quality Control 

The inspection team may review steps the firm has taken to address possible 
guality control deficiencies and assess the design and effectiveness of the underlying 
processes. In addition, the inspection team may inspect audits of issuers whose audits 
had been reviewed during previous PCAOB inspections of the firm to ascertain whether 
the audit procedures in areas with previous deficiencies have improved. 
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D.2.e.iii. Review of Certain Other Policies and Procedures Related 
to Monitoring Audit Quality 

The inspection team may assess policies, procedures, and guidance related to 
aspects of independence requirements and the firm's consultation processes, as well as 
the firm's compliance with these requirements and processes. In addition, the inspection 
team may review documents, including certain newly issued policies and procedures, 
and interview firm management to consider the firm's methods for developing audit 
policies, procedures, and methodologies, including internal guidance and training 
materials. 


END OF PART I 
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PART II, PART III, AND APPENDIX A OF THIS REPORT ARE 
NONPUBLIC AND ARE OMITTED FROM THIS PUBLIC DOCUMENT 
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APPENDIX B 

RESPONSE OF THE FIRM TO DRAFT INSPECTION REPORT 

Pursuant to section 104(f) of the Act, 15 U.S.C. § 7214(f), and PCAOB Rule 
4007(a), the Firm provided a written response to a draft of this report. Pursuant to 
section 104(f) of the Act and PCAOB Rule 4007(b), the Firm's response, minus any 
portion granted confidential treatment, is attached hereto and made part of this final 
inspection report. 13 


The Board does not make public any of a firm's comments that address a 
nonpublic portion of the report unless a firm specifically requests otherwise. In some 
cases, the result may be that none of a firm's response is made publicly available. In 
addition, pursuant to section 104(f) of the Act and PCAOB Rule 4007(b), if a firm 
requests, and the Board grants, confidential treatment for any of the firm's comments on 
a draft report, the Board does not include those comments in the final report at all. The 
Board routinely grants confidential treatment, if requested, for any portion of a firm's 
response that addresses any point in the draft that the Board omits from, or any 
inaccurate statement in the draft that the Board corrects in, the final report. 



i 



KPMG LLP 

345 Park Avenue 

New York, NY 10154-0102 


Telephone +1 212 758 9700 
kpmg.com 


January 11,2019 
Mr. George Botic 

Director - Division of Registration and Inspections 
Public Company Accounting Oversight Board 
1666 K Street, N.W. 

Washington, DC 20006-2803 

Re: Response to Part I of Draft Report on the 2017 Inspection of KPMG LLP 

Dear Mr. Botic: 

We are pleased to provide our response to Part I of the Public Company Accounting Oversight 
Board’s (“PCAOB”) Draft Report on 2017 Inspection of KPMG LLP dated December 18, 2018 (“Draft 
Report”). 

We take the findings from the PCAOB inspection process seriously and believe the inspection process 
provides valuable insights to improve the quality of our audits. We are committed to full cooperation with 
the PCAOB, appreciate the professionalism and commitment of the PCAOB staff, and value the 
important role the PCAOB plays in improving audit quality. 

We conducted a thorough evaluation of the matters identified in Part I of the Draft Report and have taken 
appropriate actions to address the engagement-specific findings in a manner consistent with 
PCAOB auditing standards and KPMG policies and procedures. 

Consistently executing quality audits is our top priority. We remain dedicated to continuous 
improvement in our audit engagement performance and our system of audit quality control. We 
understand that many of our stakeholders are interested in our overall efforts to improve audit quality, 
including the specific actions we have taken and continue to take. These actions are included in our 2018 
Audit Quality Report. We understand our responsibility to our stakeholders and are committed to working 
constructively with the PCAOB in the months and years to come. 

Sincerely yours, 


KPMG LLP 




Lynne M. Doughtie 

Chairman and Chief Executive Officer 


Frank E. Casal 
Vice Chair -Audit 
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APPENDIX C 

AUDITING STANDARDS REFERENCED IN PART I 

This appendix provides the text of the auditing standard paragraphs that are 
referenced in Part I .A of this report. Footnotes that are included in this appendix, and 
any other Notes, are from the original auditing standards that are referenced. While this 
appendix contains the specific portions of the relevant standards cited with respect to 
the deficiencies in Part I.A of this report, other portions of the standards (including those 
described in Part I.B of this report) may provide additional context, descriptions, related 
requirements, or explanations; the complete standards are available on the PCAOB's 
website at http://pcaobus.org/STANDARDS/Pages/default.aspx. 


AS 1105, Audit Evidence 

SUFFICIENT 

APPROPRIATE AUDIT 
EVIDENCE 



Using Information 

Produced by the Company 



AS 1105.10 

When using information produced by the company 
as audit evidence, the auditor should evaluate whether the 
information is sufficient and appropriate for purposes of the 
audit by performing procedures to: 3 

■ Test the accuracy and completeness of the 
information, or test the controls over the accuracy 
and completeness of that information; and 

■ Evaluate whether the information is sufficiently 
precise and detailed for purposes of the audit. 

Issuer D 

Footnote to AS 1105.10 

When using the work of a specialist engaged or employed by management, see AS 1210, 
Using the Work of a Specialist. When using information produced by a service organization or a service 
auditor's report as audit evidence, see AS 2601, Consideration of an Entity's Use of a Service Organization, 
and for integrated audits, see AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated 
with An Audit of Financial Statements. 


AS 2101, Audit Planning 

PLANNING AN AUDIT 



Multi-Location 

Engagements 



AS 2101.11 

In an audit of the financial statements of a 
company with operations in multiple locations or business 
units, 13 the auditor should determine the extent to which 

Issuer E 
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AS 2101, Audit Planning 


audit procedures should be performed at selected 
locations or business units to obtain sufficient appropriate 
evidence to obtain reasonable assurance about whether 
the consolidated financial statements are free of material 
misstatement. This includes determining the locations or 
business units at which to perform audit procedures, as 
well as the nature, timing, and extent of the procedures to 
be performed at those individual locations or business 
units. The auditor should assess the risks of material 
misstatement to the consolidated financial statements 
associated with the location or business unit and correlate 
the amount of audit attention devoted to the location or 
business unit with the degree of risk of material 
misstatement associated with that location or business 
unit. 


Footnote to AS 2101.11 

13 The term "business units" includes subsidiaries, divisions, branches, components, or 

investments. 

AS 2101.12 

Factors that are relevant to the assessment of the 
risks of material misstatement associated with a particular 
location or business unit and the determination of the 
necessary audit procedures include: 

a. The nature and amount of assets, liabilities, and 
transactions executed at the location or business 
unit, including, e.g., significant transactions that 
are outside the normal course of business for the 
company or that otherwise appear to be unusual 
due to their timing, size, or nature ("significant 
unusual transactions") executed at the location or 
business unit; 14 

b. The materiality of the location or business unit; 15 

c. The specific risks associated with the location or 
business unit that present a reasonable 
possibility 16 of material misstatement to the 
company's consolidated financial statements; 

d. Whether the risks of material misstatement 
associated with the location or business unit 
apply to other locations or business units such 
that, in combination, they present a reasonable 
possibility of material misstatement to the 
company's consolidated financial statements; 

e. The degree of centralization of records or 
information processing; 

f. The effectiveness of the control environment, 
particularly with respect to management's control 

Issuer E 
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AS 2101 , Audit Planning 

over the exercise of authority delegated to others 
and its ability to effectively supervise activities at 
the location or business unit; and 

g. The frequency, timing, and scope of monitoring 
activities by the company or others at the location 
or business unit. 

Note: When performing an audit of internal 
control over financial reporting, refer to Appendix 
B, Special Topics, of AS 2201 17 for considerations 
when a company has multiple locations or 
business units. 


Footnotes to AS 2101.12 

14 Paragraph .66 of AS 2401, Consideration of Fraud in a Financial Statement Audit. 

AS 2105.10 describes the consideration of materiality in planning and performing audit 
procedures at an individual location or business unit. 

There is a reasonable possibility of an event, as used in this standard, when the likelihood of 
the event is either "reasonably possible" or "probable," as those terms are used in the FASB Accounting 
Standards Codification, Contingencies Topic, paragraph 450-20-25-1. 

17 AS 2201 .B10-.B16. 


AS 2110, Identifying and Assessing Risks of Material Misstatement 

Factors Relevant to 
Identifying Fraud Risks 



AS 2110.65 

The auditor should evaluate whether the 
information gathered from the risk assessment procedures 
indicates that one or more fraud risk factors are present 
and should be taken into account in identifying and 
assessing fraud risks. Fraud risk factors are events or 
conditions that indicate (1) an incentive or pressure to 
perpetrate fraud, (2) an opportunity to carry out the fraud, 
or (3) an attitude or rationalization that justifies the 
fraudulent action. Fraud risk factors do not necessarily 
indicate the existence of fraud; however, they often are 
present in circumstances in which fraud exists. Examples 
of fraud risk factors related to fraudulent financial reporting 
and misappropriation of assets are listed in AS 2401.85. 
These illustrative risk factors are classified based on the 
three conditions discussed in this paragraph, which 
generally are present when fraud exists. 

Issuer A 
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AS 2110, Identifying and Assessing Risks of Material Misstatement 


Note: The factors listed in AS 2401.85 cover a 
broad range of situations and are only examples. 
Accordingly, the auditor might identify additional 
or different fraud risk factors. 



AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of 
Financial Statements 

USING A TOP-DOWN 
APPROACH 



Selecting Controls to Test 



AS 2201.39 

The auditor should test those controls that are 
important to the auditor's conclusion about whether the 
company's controls sufficiently address the assessed risk 
of misstatement to each relevant assertion. 

Issuers A, B, C, 
F, G, H, J, K, M, 
N, O, Q, R, S, 
and T 

TESTING CONTROLS 



Testing Design 
Effectiveness 



AS 2201.42 

The auditor should test the design effectiveness of 
controls by determining whether the company's controls, if 
they are operated as prescribed by persons possessing the 
necessary authority and competence to perform the control 
effectively, satisfy the company's control objectives and 
can effectively prevent or detect errors or fraud that could 
result in material misstatements in the financial statements. 

Note: A smaller, less complex company might 
achieve its control objectives in a different manner 
from a larger, more complex organization. For 
example, a smaller, less complex company might 
have fewer employees in the accounting function, 
limiting opportunities to segregate duties and 
leading the company to implement alternative 
controls to achieve its control objectives. In such 
circumstances, the auditor should evaluate 
whether those alternative controls are effective. 

Issuers A, B, C, 
D, G, H, 1, J, K, L, 
R, S, T, V, and 
W. 

Testing Operating 
Effectiveness 



AS 2201.44 

The auditor should test the operating effectiveness 
of a control by determining whether the control is operating 
as designed and whether the person performing the control 
possesses the necessary authority and competence to 
perform the control effectively. 

Issuers A, B, C, 
D, G, H, 1, J, K, L, 
R, S, V, and Z 
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AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of 
Financial Statements 


Note: In some situations, particularly in smaller 
companies, a company might use a third party to 
provide assistance with certain financial reporting 
functions. When assessing the competence of 
personnel responsible for a company's financial 
reporting and associated controls, the auditor may 
take into account the combined competence of 
company personnel and other parties that assist 
with functions related to financial reporting. 


Relationship of Risk to the 
Evidence to be Obtained 



AS 2201.46 

For each control selected for testing, the evidence 
necessary to persuade the auditor that the control is 
effective depends upon the risk associated with the control. 
The risk associated with a control consists of the risk that 
the control might not be effective and, if not effective, the 
risk that a material weakness would result. As the risk 
associated with the control being tested increases, the 
evidence that the auditor should obtain also increases 

Note: Although the auditor must obtain evidence 
about the effectiveness of controls for each 
relevant assertion, the auditor is not responsible 
for obtaining sufficient evidence to support an 
opinion about the effectiveness of each individual 
control. Rather, the auditor's objective is to 
express an opinion on the company's internal 
control over financial reporting overall. This allows 
the auditor to vary the evidence obtained regarding 
the effectiveness of individual controls selected for 
testing based on the risk associated with the 
individual control. 

Issuers N and U 

AS 2201.47 

Factors that affect the risk associated with a 
control include - 

■ The nature and materiality of misstatements that 
the control is intended to prevent or detect; 

■ The inherent risk associated with the related 
account(s) and assertion(s); 

■ Whether there have been changes in the volume 
or nature of transactions that might adversely 
affect control design or operating effectiveness; 

■ Whether the account has a history of errors; 

■ The effectiveness of entity-level controls, 
especially controls that monitor other controls; 

■ The nature of the control and the frequency with 

Issuers N and U 
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AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of 
Financial Statements 


which it operates; 

■ The degree to which the control relies on the 
effectiveness of other controls (e.g., the control 
environment or information technology general 
controls); 

■ The competence of the personnel who perform 
the control or monitor its performance and 
whether there have been changes in key 
personnel who perform the control or monitor its 
performance; 

■ Whether the control relies on performance by an 
individual or is automated (/'.e., an automated 
control would generally be expected to be lower 
risk if relevant information technology general 
controls are effective); and 

Note: A less complex company or business 
unit with simple business processes and 
centralized accounting operations might 
have relatively simple information systems 
that make greater use of off-the-shelf 
packaged software without modification. In 
the areas in which off-the-shelf software is 
used, the auditor's testing of information 
technology controls might focus on the 
application controls built into the pre¬ 
packaged software that management relies 
on to achieve its control objectives and the 

IT general controls that are important to the 
effective operation of those application 
controls. 

■ The complexity of the control and the significance 
of the judgments that must be made in 
connection with its operation. 

Note: Generally, a conclusion that a control is 
not operating effectively can be supported by 
less evidence than is necessary to support a 
conclusion that a control is operating 
effectively. 


AS 2201.55 

Roll-Forward Procedures. When the auditor 
reports on the effectiveness of controls as of a specific date 
and obtains evidence about the operating effectiveness of 
controls at an interim date, he or she should determine 
what additional evidence concerning the operation of the 
controls for the remaining period is necessary. 

Issuer J 
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AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of 
Financial Statements 

EVALUATING IDENTIFIED 
DEFICIENCIES 



AS 2201.62 

The auditor must evaluate the severity of each 
control deficiency that comes to his or her attention to 
determine whether the deficiencies, individually or in 
combination, are material weaknesses as of the date of 
management's assessment. In planning and performing the 
audit, however, the auditor is not required to search for 
deficiencies that, individually or in combination, are less 
severe than a material weakness. 

Issuer X 

APPENDIX B - Special 
Topics 



MULTIPLE LOCATIONS 

SCOPING DECISIONS 



AS 2201.B11 

In assessing and responding to risk, the auditor 
should test controls over specific risks that present a 
reasonable possibility of material misstatement to the 
company's consolidated financial statements. In lower-risk 
locations or business units, the auditor first might evaluate 
whether testing entity-level controls, including controls in 
place to provide assurance that appropriate controls exist 
throughout the organization, provides the auditor with 
sufficient evidence. 

Issuer E 

USE OF SERVICE 
ORGANIZATIONS 



AS 2201.B22 

If the service auditor's report on controls placed in 
operation and tests of operating effectiveness contains a 
qualification that the stated control objectives might be 
achieved only if the company applies controls 
contemplated in the design of the system by the service 
organization, the auditor should evaluate whether the 
company is applying the necessary procedures. 

Issuer S 


AS 2301, The Auditor's Responses to the Risks of Material Misstatement 

RESPONSES INVOLVING 
THE NATURE, TIMING, 

AND EXTENT OF AUDIT 
PROCEDURES 



AS 2301.08 

The auditor should design and perform audit 
procedures in a manner that addresses the assessed 
risks of material misstatement for each relevant assertion 
of each significant account and disclosure. 

Issuers B, E, G, 
K, O, and R 
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AS 2301, The Auditor's Responses to the Risks of Material Misstatement 

TESTING CONTROLS 



Testing Controls in an 

Audit of Financial 

Statements 



AS 2301.16 

Controls to be Tested. If the auditor plans to 
assess control risk at less than the maximum by relying on 
controls, 12 and the nature, timing, and extent of planned 
substantive procedures are based on that lower 
assessment, the auditor must obtain evidence that the 
controls selected for testing are designed effectively and 
operated effectively during the entire period of reliance. 13 
However, the auditor is not required to assess control risk 
at less than the maximum for all relevant assertions and, 
for a variety of reasons, the auditor may choose not to do 
so. 

Issuers A, B, C, 

F, H, 1, J, L, M, 
O, T, U, and W 

Footnotes to AS 2301.16 

12 Reliance on controls that is supported by sufficient and appropriate audit evidence allows the 
auditor to assess control risk at less than the maximum, which results in a lower assessed risk of material 
misstatement. In turn, this allows the auditor to modify the nature, timing, and extent of planned substantive 
procedures. 

13 Terms defined in Appendix A, Definitions , are set in boldface type the first time they appear. 

AS 2301.18 

Evidence about the Effectiveness of Controls in 
the Audit of Financial Statements. In designing and 
performing tests of controls for the audit of financial 
statements, the evidence necessary to support the 
auditor's control risk assessment depends on the degree 
of reliance the auditor plans to place on the effectiveness 
of a control. The auditor should obtain more persuasive 
audit evidence from tests of controls the greater the 
reliance the auditor places on the effectiveness of a 
control. The auditor also should obtain more persuasive 
evidence about the effectiveness of controls for each 
relevant assertion for which the audit approach consists 
primarily of tests of controls, including situations in which 
substantive procedures alone cannot provide sufficient 
appropriate audit evidence. 

Issuers A, B, C, 

F, H, 1, J, L, M, 
O, T, U, and W 

SUBSTANTIVE 

PROCEDURES 



AS 2301.37 

As the assessed risk of material misstatement 
increases, the evidence from substantive procedures that 
the auditor should obtain also increases. The evidence 
provided by the auditor's substantive procedures depends 
upon the mix of the nature, timing, and extent of those 
procedures. Further, for an individual assertion, different 

Issuers A, B, C, 
F, H, 1, J, L, M, 
O, T, U, and W 




PCAOB Release No. 104-2019-002 
Inspection of KMPG LLP 
January 24, 2019 
Page C-9 


AS 2301, The Auditor's Responses to the Risks of Material Misstatement 


combinations of the nature, timing, and extent of testing 
might provide sufficient appropriate evidence to respond 
to the assessed risk of material misstatement. 



AS 2305, Substantive Anal 

ytical Procedures 

AS 2305.05 

Analytical procedures involve comparisons of 
recorded amounts, or ratios developed from recorded 
amounts, to expectations developed by the auditor. The 
auditor develops such expectations by identifying and using 
plausible relationships that are reasonably expected to exist 
based on the auditor's understanding of the client and of 
the industry in which the client operates. Following are 
examples of sources of information for developing 
expectations: 

a. Financial information for comparable prior period(s) 
giving consideration to known changes 

b. Anticipated results—for example, budgets, or 
forecasts including extrapolations from interim or 
annual data 

c. Relationships among elements of financial 
information within the period 

d. Information regarding the industry in which the 
client operates—for example, gross margin 
information 

e. Relationships of financial information with relevant 
nonfinancial information 

Issuer F 

ANALYTICAL 

PROCEDURES USED AS 
SUBSTANTIVE TESTS 



Plausibility and 
Predictability of the 
Relationship 



AS 2305.13 

It is important for the auditor to understand the 
reasons that make relationships plausible because data 
sometimes appear to be related when they are not, which 
could lead the auditor to erroneous conclusions. In addition, 
the presence of an unexpected relationship can provide 
important evidence when appropriately scrutinized. 

Issuers F and T 

AS 2305.14 

As higher levels of assurance are desired from 
analytical procedures, more predictable relationships are 
required to develop the expectation. Relationships in a 

Issuers F and T 
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stable environment are usually more predictable than 
relationships in a dynamic or unstable environment. 
Relationships involving income statement accounts tend to 
be more predictable than relationships involving only 
balance sheet accounts since income statement accounts 
represent transactions over a period of time, whereas 
balance sheet accounts represent amounts as of a point in 
time. Relationships involving transactions subject to 
management discretion are sometimes less predictable. For 
example, management may elect to incur maintenance 
expense rather than replace plant and equipment, or they 
may delay advertising expenditures. 


Investigation and 

Evaluation of Significant 
Differences 



AS 2305.20 

In planning the analytical procedures as a 
substantive test, the auditor should consider the amount of 
difference from the expectation that can be accepted 
without further investigation. This consideration is 
influenced primarily by materiality and should be consistent 
with the level of assurance desired from the procedures. 
Determination of this amount involves considering the 
possibility that a combination of misstatements in the 
specific account balances, or class of transactions, or other 
balances or classes could aggregate to an unacceptable 
amount. 

Issuer F 


AS 2310, The Confirmation Process 

ALTERNATIVE 

PROCEDURES 



AS 2310.31 

When the auditor has not received replies to 
positive confirmation requests, he or she should apply 
alternative procedures to the nonresponses to obtain the 
evidence necessary to reduce audit risk to an acceptably 
low level. Flowever, the omission of alternative procedures 
may be acceptable (a) when the auditor has not identified 
unusual qualitative factors or systematic characteristics 
related to the nonresponses, such as that all nonresponses 
pertain to year-end transactions, and ( b ) when testing for 
overstatement of amounts, the nonresponses in the 
aggregate, when projected as 100 percent misstatements 
to the population and added to the sum of all other 
unadjusted differences, would not affect the auditor's 
decision about whether the financial statements are 
materially misstated. 

Issuers B and P 
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AS 2315, Audit Sampling 

SAMPLING IN 
SUBSTANTIVE TESTS OF 
DETAILS 



Planning Samples 



AS 2315.19 

After assessing and considering the levels of 
inherent and control risks, the auditor performs substantive 
tests to restrict detection risk to an acceptable level. As the 
assessed levels of inherent risk, control risk, and detection 
risk for other substantive procedures directed toward the 
same specific audit objective decreases, the auditor's 
allowable risk of incorrect acceptance for the substantive 
tests of details increases and, thus, the smaller the 
required sample size for the substantive tests of details. 
For example, if inherent and control risks are assessed at 
the maximum, and no other substantive tests directed 
toward the same specific audit objectives are performed, 
the auditor should allow for a low risk of incorrect 
acceptance for the substantive tests of details. 3 Thus, the 
auditor would select a larger sample size for the tests of 
details than if he allowed a higher risk of incorrect 
acceptance. 

Issuers A, B, C, 
F, H, 1, J, L, M, 
O, T, U, and W 

Footnote to AS 2315.19 

Some auditors prefer to think of risk levels in quantitative terms. For example, in the 
circumstances described, an auditor might think in terms of a 5 percent risk of incorrect acceptance for the 
substantive test of details. Risk levels used in sampling applications in other fields are not necessarily relevant 
in determining appropriate levels for applications in auditing because an audit includes many interrelated tests 
and sources of evidence. 

AS 2315.23 

To determine the number of items to be selected 
in a sample for a particular substantive test of details, the 
auditor should take into account tolerable misstatement for 
the population; the allowable risk of incorrect acceptance 
(based on the assessments of inherent risk, control risk, 
and the detection risk related to the substantive analytical 
procedures or other relevant substantive tests); and the 
characteristics of the population, including the expected 
size and frequency of misstatements. 

Issuers A, B, C, 
F, H, 1, J, L, M, 
O, T, U, and W 

AS 2315.23A 

Table 1 of the Appendix describes the effects of 
the factors discussed in the preceding paragraph on 
sample sizes in a statistical or nonstatistical sampling 
approach. When circumstances are similar, the effect on 
sample size of those factors should be similar regardless 
of whether a statistical or nonstatistical approach is used. 
Thus, when a nonstatistical sampling approach is applied 
properly, the resulting sample size ordinarily will be 
comparable to, or larger than, the sample size resulting 
from an efficient and effectively designed statistical 
sample. 

Issuers A, B, C, 
F, H, 1, J, L, M, 
O, T, U, and W 
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AS 2501 , Auditing Accounting Estimates 

EVALUATING 

ACCOUNTING 

ESTIMATES 



AS 2501.07 

The auditor's objective when evaluating accounting 
estimates is to obtain sufficient appropriate evidential 
matter to provide reasonable assurance that— 

a. All accounting estimates that could be material to 
the financial statements have been developed. 

b. Those accounting estimates are reasonable in the 
circumstances. 

c. The accounting estimates are presented in 
conformity with applicable accounting principles 2 
and are properly disclosed. 3 

Issuer P 

Footnotes to AS 2501.07 

AS 2815, The Meaning of "Present Fairly in Conformity With Generally Accepted Accounting 
Principles," discusses the auditor's responsibility for evaluating conformity with generally accepted accounting 
principles. 

See paragraph .31 of AS 2810, Evaluating Audit Results. 

Evaluating 

Reasonableness 



AS 2501.11 

Review and test management's process. In many 
situations, the auditor assesses the reasonableness of an 
accounting estimate by performing procedures to test the 
process used by management to make the estimate. The 
following are procedures the auditor may consider 
performing when using this approach: 

a. Identify whether there are controls over the 
preparation of accounting estimates and 
supporting data that may be useful in the 
evaluation. 

b. Identify the sources of data and factors that 
management used in forming the assumptions, 
and consider whether such data and factors are 
relevant, reliable, and sufficient for the purpose 
based on information gathered in other audit tests. 

c. Consider whether there are additional key factors 
or alternative assumptions about the factors. 

d. Evaluate whether the assumptions are consistent 
with each other, the supporting data, relevant 
historical data, and industry data. 

e. Analyze historical data used in developing the 

Issuers A, B, C, 
F, G, and T 
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assumptions to assess whether the data is 
comparable and consistent with data of the period 
under audit, and consider whether such data is 
sufficiently reliable for the purpose. 

f. Consider whether changes in the business or 
industry may cause other factors to become 
significant to the assumptions. 

g. Review available documentation of the 
assumptions used in developing the accounting 
estimates and inquire about any other plans, goals, 
and objectives of the entity, as well as consider 
their relationship to the assumptions. 

h. Consider using the work of a specialist regarding 
certain assumptions (AS 1210, Using the Work of a 
Specialist). 

i. Test the calculations used by management to 
translate the assumptions and key factors into the 
accounting estimate. 



AS 2502, Auditing Fair Value Measurements and Disclosures 

TESTING THE ENTITY'S 
FAIR VALUE 
MEASUREMENTS AND 
DISCLOSURES 



Testing Management's 
Significant Assumptions, 
the Valuation Model, and 
the Underlying Data 



AS 2502.26 

The auditor's understanding of the reliability of the 
process used by management to determine fair value is an 
important element in support of the resulting amounts and 
therefore affects the nature, timing, and extent of audit 
procedures. When testing the entity's fair value 
measurements and disclosures, the auditor evaluates 
whether: 

a. Management's assumptions are reasonable and 
reflect, or are not inconsistent with, market 
information (see paragraph .06). 

b. The fair value measurement was determined using 
an appropriate model, if applicable. 

c. Management used relevant information that was 
reasonably available at the time. 

Issuers D, 1, K, 
and P 

AS 2502.28 

Where applicable, the auditor should evaluate 
whether the significant assumptions used by management 

Issuers D, 1, K, 
and P 
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in measuring fair value, taken individually and as a whole, 
provide a reasonable basis for the fair value measurements 
and disclosures in the entity's financial statements. 


AS 2502.39 

The auditor should test the data used to develop 
the fair value measurements and disclosures and evaluate 
whether the fair value measurements have been properly 
determined from such data and management's 
assumptions. Specifically, the auditor evaluates whether 
the data on which the fair value measurements are based, 
including the data used in the work of a specialist, is 
accurate, complete, and relevant; and whether fair value 
measurements have been properly determined using such 
data and management's assumptions. The auditor's tests 
also may include, for example, procedures such as 
verifying the source of the data, mathematical 
recomputation of inputs, and reviewing of information for 
internal consistency, including whether such information is 
consistent with management's intent and ability to carry out 
specific courses of action discussed in paragraph .17. 

Issuers A and D 

Developing Independent 

Fair Value Estimates for 
Corroborative Purposes 



AS 2502.40 

The auditor may make an independent estimate of 
fair value (for example, by using an auditor-developed 
model) to corroborate the entity's fair value measurement. 6 
When developing an independent estimate using 
management's assumptions, the auditor evaluates those 
assumptions as discussed in paragraphs .28 to .37. Instead 
of using management's assumptions, the auditor may 
develop his or her own assumptions to make a comparison 
with management's fair value measurements. In that 
situation, the auditor nevertheless understands 
management's assumptions. The auditor uses that 
understanding to ensure that his or her independent 
estimate takes into consideration all significant variables 
and to evaluate any significant difference from 
management's estimate. The auditor also should test the 
data used to develop the fair value measurements and 
disclosures as discussed in paragraph .39. 

Issuer K 

Footnote to AS 2502.40 

6 See AS 2305, Substantive Analytical Procedures. 
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DISCLOSURES ABOUT 

FAIR VALUES 



AS 2502.43 

The auditor should evaluate whether the 
disclosures about fair values made by the entity are in 
conformity with GAAP. 8 Disclosure of fair value information 
is an important aspect of financial statements. Often, fair 
value disclosure is required because of the relevance to 
users in the evaluation of an entity's performance and 
financial position. In addition to the fair value information 
required under GAAP, some entities disclose voluntary 
additional fair value information in the notes to the financial 
statements. 

Issuer K 

Footnote to AS 2502.43 

See also paragraph .31 of AS 2810, Evaluating Audit Results. 


AS 2810, Evaluating Audit Results 

EVALUATING THE 

RESULTS OF THE AUDIT 

OF FINANCIAL 
STATEMENTS 



AS 2810.03 

In forming an opinion on whether the financial 
statements are presented fairly, in all material respects, in 
conformity with the applicable financial reporting 
framework, the auditor should take into account all relevant 
audit evidence, regardless of whether it appears to 
corroborate or to contradict the assertions in the financial 
statements. 

Issuer Y 






